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Abstract 



We describe an efficient algorithm for the computation of isogenies between abelian 
varieties represented in the coordinate system provided by algebraic theta functions. 
We explain how to compute all the isogenies from an abelian variety whose kernel 
is isomorphic to a given abstract group. We also describe an analog of Velu's 
formulas to compute an isogeny with a prescribed kernel. All our algorithms rely 
in an essential manner on a generalization of the Riemann formulas. 

In order to improve the efficiency of our algorithms, we introduce a point com- 
pression algorithm that represents a point of level Al oi a g dimensional abelian 
variety using only ^(^ + l)/2 • 4^ coordinates. We also give formulas to compute 
the Weil and commutator pairing given input points in theta coordinates. All the 
algorithms presented in this paper work in general for any abelian variety defined 
over a field of odd characteristic. 
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1 Introduction 



1 Introduction 

In this paper, we are interested in some algorithmic aspects of isogeny computations 
between abelian varieties. Computing isogenics between abelian varieties may be seen 
as different kind of computational problems depending on the expected input and 
output of the algorithm. These problems are: 

• Given an abelian variety A/^ and an abstract finite abelian group K compute all 
the abelian varieties Bj. such that there exists an isogeny A^- Bj. whose kernel 
is isomorphic to K, and compute these isogenics. 

• Given an abelian variety A]^ and a finite subgroup K of A^, recover the quotient 
abelian variety B^ = A/^/K as well as the isogeny A^- Bj.. 

• Given two isogenous abelian varieties, Aj^ and Bj^, compute explicit equations 
for an isogeny map Aj^ Bf^. 

Here, we are concerned with the first two problems. In the case that the abelian 
variety is an elliptic curve, efficient algorithms have been described that solve all the 
aforementioned problems [ ] . For higher-dimensional abelian varieties much less is 
known. Richelot's formulas [MesOl, Mes02] can be used to compute (2, 2)-isogenies 
between abelian varieties of dimension 2. The paper [c^- j ^jg^ introduced a method 
to compute certain isogenics of degree 8 between Jacob ian of curves of genus three. In 
this paper, we present an algorithm to compute {£,..., £)-isogenies between abelian 
varieties of dimension g for any £ ^ 2 and g ^ 1- Possible applications of our algorithm 
includes: 

• The transfer the discrete logarithm from an abelian variety to another abelian 
variety where the discrete logarithm is easy to solve [Smi08] 

• The computation of isogeny graph to obtain a description the endomorphism 
ring of an Abelian variety. 

By Torelli's theorem there is a one on one correspondence between principally po- 
larized abelian varieties of dimension 2 and Jacobians of genus 2 hyperelliptic curves. 
Thus the modular space of principally polarized abelian varieties of dimension 2 is 
parametrized by the three Igusa invariants, and one can define modular pol5momials 
between these invariants much in the same way as in the genus-one case [ ]. 
However the height of these modular pol5momials explodes with the order, making 
their computations impractical: only those are known [ ]. In order to circumvent 
this problem, in the article [ ], we have defined a modular correspondence be- 
tween abelian varieties in the moduli of marked abelian varieties. This moduli space 
is well-suited for computating modular correspondences since the associated modular 
polynomials have their coefficients in {1,-1}, and there is no explosion as before. 

In this paper, we explain how, given a solution to this modular correspondence 
(provided for instance by the algorithm described in [FLR09]), one can compute the 
associated isogeny. Once such a modular point is obtained, the isogeny can be com- 
puted using only simple addition formulas of algebraic theta functions, so in practice. 



5 



2 Computing Isogenies 



the computation of the isogeny takes much less time than the computation of a point 
provided by the modular correspondence. Note that this is similar to the genus-one 
case. For elliptic curves, the computation of a root of the modular polynomial is not 
mandatory if the points in the kernel of the isogeny are given, since this is the input 
taken by Vein's formulas. Here, we explain how to recover the equations of an isogeny 
given the points of its kernel, yielding a generalization of Vein's formulas. 

Our generalization introduces however a difference compared to the usual genus-1 
case. For elliptic curves, the modular polynomial of order £ give the moduli space of 
£-isogenous elliptic curves. In our generalized setting, the modular correspondence in 
the coordinate system of theta null points gives ^^^-isogenous abelian varieties with 
a theta structure of different level. As a consequence, a point in this modular space 
corresponds to an £S^-isogeny, together with a symplectic structure of level £. Another 
method would be to describe a modular correspondence between abelian varieties 
with theta structures of the same level, see [.j^u^a. ] for an example with 1 = 3 and 



The paper is organized as follow. In Section 2 we recall Vein's formulas and outline 
our algorithms. In Section 3, we recall the definition of the modular correspondence 
given in [FLR09], and we study the relationship between isogenies and the action of 
the theta group. We recall the addition relations, which play a central role in this paper 
in Section 4. We then explain how to compute the isogeny associated to a modular 
point in Section 5. If the isogeny is given by theta functions of level 4^, it requires (4£)^ 
coordinates. We give a point compression algorithm in Section 5.1, showing how to 
express such an isogeny with only g{g + l)/2 ■ 4^ coordinates. In Section 6 we give 
a full generalization of Vein's formulas that constructs an isogenous modular point 
with prescribed kernel. This algorithm is more efficient than the special Grobner basis 
algorithm from [, ]. There is a strong connection between isogenies and pairings, 
and we use the above work to explain how one can compute the commutator pairing 
and how it relates to the usual Weil pairing in Section 7. 

2 Computing Isogenies 

In this section, we recall how one can compute isogenies between elliptic curves. We 
then outline our algorithm to compute isogenies between abelian varieties. 

2.1 Elliptic curves and Velu's formulas 

Let (£j./ Oej) be an elliptic curve given by a Weierstrass equation = f{x) with / a 
degree-3 monic polynomial. Velu's formulas rely on the intrinsic characterization of 
the coordinate system giving the Weierstrass model of £jt ^s: 




-3 



z;p(x)^0 if P 7^ Of, 



= 1, 



-2 



(1) 
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where vq denotes the valuation of the local ring of Ej^ in the closed point Q. 
Theorem 2.1 (Velu): 

Let G C E]^{k) be a finite subgroup. Then E^/G is given by = g{X) with g a degree 3 
monic polynomial where 

X{P)=x{P)+ J2 xiP + Q)-x{Q) 

Y{p) = y{p)+ J2 y{P + Q)-y{Q) 

Q6G\{0£j 



Proof: Indeed, X and Y are in A:(Ej-)'^/ and it is easily seen that they satisfy the rela- 
tions (1). ■ 

A consequence of the that theorem is that, given a finite subgroup G of cardinality i of 
an elliptic curve £j- an equation y^ = f{x) with / a degree 3 polynomial, it is possible 
to compute the Weierstrass equation of the quotient Ej^/G at the cost of 0{£) additions 
in£fc. 

The modular curve Xo(£) parametrizes the set of isomorphism classes of elliptic 
curves together with a ^-torsion subgroup. For instance Xo(l) is just the line of j- 
invariants. Let <i>c{x,y) e Z[x,i/] be the order £ modular polynomial. It is well known 
that the roots oi (Ef^), ■) give the /-invariants of the elliptic curves ^-isogenous 
to Ej-. Since an ^-isogeny is given by a finite subgroup of E/^ of order £, we see that 
<^g{x,y) cuts out a curve isomorphic to Xo(^) in Xo(l) x Xo(l). 

Given an elliptic curve Ej^ with /-invariant /e,^, the computation of isogenies can be 
done in two steps: 

• First, find the solutions of <I>^(7ej.,X) where Of(X, Y) is the order £ modular 
polynomial; then recover from a root ]£/ the equation of the corresponding curve 

E[ which is i'-isogenous to E^-. 

• Next, using Velu's formulas, compute the isogeny E/^ E[. 

For some applications such as isogeny-graph computation, only the first step is re- 
quired, while for other applications it is necessary to obtain the explicit equations 
describing the isogeny. Note that the first step is unnecessary if one already know the 
points in the kernel of the isogeny. 

2.2 Isogenies on abelian varieties 

Let Ajf be an abelian variety of dimension g over a field k and denote by 
its function field. An isogeny is a finite surjective map of abelian varieties. In the 
following we only consider separable isogenies i.e. isogenies tt : Aj. ^> B^- such that 
the fimction field K{A)f) is a finite separable extension of X(Bi^). A separable isogeny 
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is uniquely determined by its kernel, which is a finite subgroup of Aj^ (k) . In that case, 
the cardinality of the kernel is the degree of the isogeny In the rest of this paper, by 
£-isogeny for £ > 0, we always mean a (£, ■ ■ ■ , ^) -isogeny where {£,■■■ ,i) E ZS. 

We have seen that it is possible to define a modular correspondence between the 
Igusa invariants, parameterizing the set of dimension 2 principally polarized abelian 
varieties, but the coefficients explosion of the related modular polynomials makes it 
computationally inefficient. In order to mitigate this problem and obtain formulas 
suitable for general ^-dimensional abelian varieties, we use the moduli space of marked 
abelian varieties. 

Let g e N* and let n e N be such that 2\n. Let n = {n,n,...,n) e Z^, and 
Z(m) = ZS/nZS. We denote Aijj the modular space of marked abelian varieties 
(Aj., ©A^) where ^ is a polarization and 0^^ is symmetric theta structure 0^^ of 
type Z(m) (see [Mumbt ]). The forgetting map (A;.,^, 0^^) >—> (Aj^,^) is a finite map 
from Aljf to the moduli space of abelian varieties with a polarization of type Z{n). 

We recall [Mum67a] that if 4|n, then Aif, is open in the projective variety described 
by the following equations in F{k{Z{n))): 

( E x{t)ax+tax+t)-{ J2 X{t)au+tau+t) = 
tez(2) *ez(2) 

( E x{i)az~x+taz-y+t)-{ E X{i)az--u+taz-v+t) (2) 
tez(2) tez(2) 

ax = a-x 

for all x,y, m,c e Z(m), such that x + y + u + v = 2z and all x G ^{2). 

In [FLR09], we have described a modular correspondence (p : M.j^ Mn x for 
£ G IN*, which can be seen as a generalization of the modular correspondence Xq (^) 
Xo(l) X Xo(l) for elliptic curves. Let pi and p2 be the corresponding projections 
Mn X Mn Mn, and let <pi = pi o cp, (p2 = P2° (p- The map cpi : Mj^ is 
such that (x, q>i{x)) are modular points corresponding to £-isogenous varieties We 

recall that (p\ is defined by (pi ((^!),gz(j^)) = {ai)i^z{n) where Z{n) is identified as a 

subgroup of Z(^n) by the map x i— )• £x. 

Suppose that we are given a modular point {bi)j^z{n) corresponding to the marked 
abelian variety (Bj., ^g, 08^ )■ If B/^ is the Jacobian variety of an hyperelliptic curve, one 
may recover the associated modular point for n = 4 via Thomae formulas [VliimS4]. 

Suppose for now that 4| n and that £ is prime to n. Our algorithm works in two steps: 

1. Modular computation Compute a modular point G iPi^ ((^i)/eZ{H)) • 
This can be done via the specialized Grobner basis algorithm described in 
[FLR09], but see also Section 6 for a more efficient method. 

2. Velu's like formulas Use the addition formula in Bj^ to compute the isogeny 
JT : —> Ajf associated to the modular point solution. Here ( A^-, 0^^ ) is the 
marked abelian variety corresponding to {ni) i^^^iln)- ^^^^ step is described in 
Section 5. 
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We can also compute an isogeny given by its kernel K by using the results of 
Section 6.1 to construct the corresponding modular point (^i)/ez(?«) from K. We thus 
have a complete generalization of Velu's formulas for higher dimensional abelian 
varieties since the reconstruction of the modular point (^i)/gz(lfj) from the kernel K 
only requires the addition formulas in Bj- (together with the extraction of ^^'^ -roots). In 
Section 6.3 we explain how to use this to speed up Step 1 of our algorithm (we call this 
Step 1'). 

If the kernel of the isogeny is unknown, the most time-consuming part of our 
algorithm is the computation of a maximal subgroup of rank g of the ^-torsion, which 
means that currently, with g = 2 we can go up to ^ = 31 relying on the current 
state-of-the-art implementation [^jShas]. In order to speed up Step 2, which requires 
0{iS) additions to be performed in Bj^, and compute with a compact representation, 
it is important to consider the smallest possible n.lin = 2, we cannot prove that the 
modular system to be solved in Step 1 is of dimension 0. However Step 1', which is 
faster, does not require a modular solution but only the kernel of the isogeny, so our 
algorithm works with n = 2 too. Note, however, that some care must be taken when 
computing additions on Bj^, since the algebraic theta functions only give an embedding 
of the Kummer variety of Bj^ for n = 2. 

For an actual implementation the case n = 2 is critical (it allows for a more compact 
representation of the points than n = 4: we gain a factor 2^, it allows for a faster 
addition chain, see Section 5.1.1, but most importantly it reduces the most consuming 
part of our algorithm, the computation of the points of ^-torsion, since there are half as 
much such points on the Kummer variety). For each algorithm that we use, we give 
an explanation on how to adapt it for the level 2 case: see Section 4.2.1 and the end of 
Sections 5.2, 6.1, 6.3 and 7.2. 

The assumption that n is prime to i is not necessary either but there is one important 
difference in this case. Suppose that we are given B^- [£] . Since Bj- is given by a theta 
structure of level n, we also have Bj([n]. If £ is prime to n, this gives us Bjt[^n], and we 
can use Step 1' to reconstitute a modular point of level £n. If £ is not prime to n, we 
have to compute Bj^ [£n] directly. 

It is also possible to compute more general types of isogenies via our algorithm. 
With the notations of Section 3, let Sq = {Si, . . . , S,^) be a sequence of integers such 
that Si\Si^i, and let (t'/),gz(^g) G be a modular point corresponding to an abelian 
variety Bj,. Let S' = {£i, ...,£g) (where £i\£i+i) and define S = (^i^i, . . . , Sg£g). Let 
(«/)/6Z{^) e be such that = (&/),gz(^^g). The thetanull point (fl/),gz(^-) 

corresponds to an abelian variety Aj., such that there is a {£i, ■ ■ ■ ,£g)-isogeny tt : 
Aj^ Bj^, which can be computed by the isogeny theorem [Mum66] (see Section 3.2). 
The isogeny we compute in Step 2 is the contragredient isogeny ft : B/^ ^ Aj^ 
of type {£g/ £\, £g/ £2,--- ,1, £g, ■ ■ ■ r£g)- Using the modular correspondence (p to 
go back to a modular point of level (see Section 3.3) gives an isogeny of type 
{£gl £\, £g/ £2, ■ ■ ■ , 1, £\£g, £2£g, ■ ■ ■ , £g£g)- For the clarity of the exposition, we will stick 
to the case = n and 5 = £n and we leave to the reader the easy generalization. 

Let us make some remarks on our algorithm. First note that to compute ^-isogenics. 
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we start from a theta null point of level n to get a theta null point of level £n. We can 
then go back to a point of level n (see Section 3.3), but in this case we are computing 
isogenies. A second remark is that all our computations are geometric, not arithmetic, 
since the projective embedding given by theta functions of level £n is not rational. A 
last remark is that since we use different moduli spaces, our method is not a straight-up 
generalization of the genus-1 case. In particular, computing a modular point solution 
i^di^zijn) same as choosing an £-isogeny and a theta structure of level I, so 

there are many more modular solutions than there is £-isogenies. Hence, as noted in 
the introduction, the most efficient method in our cases is to compute the points of 
^-torsion to reconstitute the modular point. 

3 Modular correspondences and theta null points 

In this section, we recall some results of [FLR09] and notations that we will use in 
the rest of the paper. In Section 3.1 we recall the definition of a theta structure and 
the associated theta functions [iVlum66]. In Section 3.2 we recall the isogeny theorem, 
which give a relations between the theta functions of two isogenous abelian varieties. In 
Section 3.3 we explain the modular correspondence defined in [ ]. In Section 3.4 
we study the connection between isogenies and the action of the theta group. 

3.1 Theta structures 

Let Ajt be a g dimensional abelian variety over a field k. Let ^ be a degree-rf ample 
symmetric line bundle on Aj.. We suppose that d is prime to the characteristic of k 
or that Aj- is ordinary. Denote by the kernel of the isogeny <p : Aj- — > A]^, 

defined on geometric points by x i— > t*J^ ® ~^ where is the translation by x. 
Let 5 = {Si, . . . ,Sg)he the sequence of integers satisfying such that, as group 

schemes K( ) ~ 0f^j {Z/3iZ)l. We say that S is the type of .if. In the following we 
letZ((5) = ©f^^(Z/(5,Z)fc,Z((5)betheCartierdualof Z(^5),andK(^) = Z{S) x Z{S). 

Let G(^) and T-LiS) be respectively the theta group of {Aj^,^) and the Heisenberg 
group of type S [Miin ]. In this article, elements of G(^) will be written as (x, ipx) 
with X e K{J^) and xpx : ^ ^ t*^ is an isomorphism. We know that G(^) and ■^((5) 
are central extensions of K{^) and K{S) by Gm- By definition, a theta structure ©^i^ 
on (Aj-, ^) is an isomorphism of central extensions from 'H(iJ) to G(^). We denote 
by the commutator pairing [Mum66] on K{^) and by e^^s the canonical pairing 
on Z{S) X Z{S) (We often drop the indice S ine^ when there is no risk of confusion). 
We remark that a theta structure 0yi^ induces a symplectic isomorphism from 
{K{S), e,^s) to (K(if ), e^). We denote by K{^) = {^) x Kji^) the decomposition 
into maximal isotropic subspaces induced by 0^^^. The sections Z{S) V-iS) and 
Z{5) 'H{5) defined on geometric points by x (1, x,0) and y (1,0, y) can 
be transported by the theta structure to obtain natural sections Sxj(if) : 
G(^) and s^^^j^) : -K2(^) ^ G(if ) of the canonical projection k : G{^) X(if ). 
Recall [Mum66, pp. 291] that a level subgroup K of G(^) is a subgroup such that 
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K is isomorphic to its image by k. We define the maximal level subgroups Ki over 
K\[^) and K2 over K2{^) as the image by 0^^, of the subgroups {'^,x,Q)x£Z{s) 

Let V = T{Ak,^). The theta group G(^) acts on V by ip-'^T*{v) for z; e V 
and {x, ipx) E G{J!f). This action can be transported via 0/1^^ to an action of'H{S) on V. 
It can be shown that there is a unique (up to a scalar factors) basis (!?i)/ez((5) of ^ such 
that this action is given by: 

(a,f,y)-!?®^* = ^.e,,s{-i - h,i).&®^\. (3) 

(see [Mum67b, BLO-' ] for a connection between algebraic theta functions and the classi- 
cal, analytic theta functions.) If there is no ambiguity, in this paper, we will sometimes 

drop the superscript 0^^^ in the notation * . We briefly recall the construction of this 
basis: let be the quotient of Aj- by K2 {^) and n : Aj^^ A^he the natural projection. 
By Grothendieck descent theory, the data of K2 is equivalent to the data of a couple 
(^0/ ^) where ^0 is a degree-one ample line bundle on A^ and A is an isomorphism 
A : 7T* (^0) — ^ Let sq be the unique global section of up to a constant factor and 
let s = A(7r* (sq)). We have the following proposition (see [Mum66]) 

Proposition 3.1: 

For all i e Z{3), let (x,,!/;,) = 0^^((l,f,O)). We set d"^^'' = {tpx^T*{s)). The elements 

{&"l^'')i^z{5) form a basis of the global sections of J^; it is uniquely determined (up to a 
multiplicative factor independent ofi) by @a^- 

This basis gives a projective embedding : Aj. — > P^~^ which is uniquely 

defined by the theta structure 0A;,- The point (fl/),gz(^) := (^©^^(0/1^,) is called the 
theta null point associated to the theta structure. Mumford proves [Mum66] that if 
A\5, q>Q^^[A]^) is the closed subvariety of defined by the homogeneous ideal 
generated by the Riemann equations: 

Theorem 3.2 (Riemann equations): 

For all x,y,u,v e Z(2(5) that are congruent modulo Z [2), and all x G Z{2), we have 

( E X{i)^x+y+t^x-y+t)-{ E X{t)au+v+tau-v+t) = 
teZ{2) tGZ(2) 

= ( E x{t)^x+u+t^x~u+t)-{ E X{t)ay+v+tay-v+t)- (4) 
fGZ(2) tez{2) 

Let Pai:(v) ■ ^)c(^) ~^ IP/c(^) be the canonical projection. Let Aj. = 
be the affine cone of Ai^ and denote by : Aj. A]^, the application induced by 
PA(.(y) ■ Since this affine cone will play a central role in this paper, we take the following 
convention: if (!?i)/ez((5) is a homogeneous coordinate system on P(y) then we denote 
by {fii)i^z{b) the associated affine coordinate system of A(y). For instance, p/^^ is 
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given by {^i{x))i^z{s) (!9,(x)),g2{^)- K should be remarked that, for ! G Z(^),!?/isa 
well defined function on Aj. and for any geometric point x G Aj., we denote by !9, (x) 
its values in x. 

Since the action of G(Jf ) on V is affine, the action (3) gives an action on Aj^. This 
action descends to a projective action of K{Ji') on A/^ which is simply the action 
by translation. We wiU use the same notations for the action of T-LiS) (resp. of K{S)) 
induced by ©a^- 

3.2 Isogenies compatible with a tlieta structure 

Let S' E ZS be such that 2 1 ^' | ^, and write S = S' ■ S" . In the following we consider 
Z{S') as a subgroup of Z(^) via the map cp : G Z{6') i— > (<5"x,),gj;^ G Z{S). 

From now on, when we write Z{5') C Z{S), we always refer to this map. Let K be 
the subgroup iZ{S")) of K2{^) and let tzk be the isogeny A;, ^ = A/JK. By 
Grothendieck descent theory, the level subgroup K := Sx2(i?) (^^) induces a polarization 
ifo on B)t, such that ^ c± 7r|(ifo). The theta group G(^o) is isomorphic to Z{K)/K 
where 2{K) is the centralizer of K in G{J^) [Mum66]. Let ©Bj. be the unique theta 
structure on Bj. compatible with the theta structure on A^^ [FLRO'^, Sec. 3]. We have 
[FLF' , Prop. 4]: 

Proposition 3.3 (Isogeny theorem for compatible ^eta structures): 

Let (p : Z{6') — )• Z{5) be the canonical embedding. Let (i?- '')i^z{s) (^^sp. (z?- '')i^z{s')^ 

— * 

the canonical basis of^ (resp. J^q) associated to (resp. @bJ- There exists some lo E k 
such that for all i E Z{5') 

7rKi?r'*)=a.i9®J^. (5) 
In particular, the theta null point ofB}; is given by 

{i'i)iez(s'] = (^<p(i))iez(y) (6) 

The above proposition is a particular case of the more general isogeny theorem 
[Mumbb, Th. 4]. 

On the affine cones this proposition shows that, given the theta null point {cii)ii£z{S)' 
the morphism 

tzk : A,, Bfc 
makes the following diagram commutative: 
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For the sake of simplicity, we set from now on Sq = n, and S' = J so that S = £n (we 
stated Proposition (3.3) in a more general form because we can use it to compute the 
^-torsion on Bj-, see Section 6.3). Let {bj)i^2{n) ^ theta null point associated to a triple 
(Bj^, ^0'®B)t)/ we want to compute an £-isogeny Bj. A]^. Since n is fixed, we cannot 
apply the isogeny theorem directly since it requires l\n. However, if ^ 
M.j^ is a theta null point corresponding to a triple {A]^,S£,@fi^^ where the theta 
structure 0^^. is compatible with ©g^. (this is equivalent to {^i)i^z{In) satisfying (6)), 
then Proposition 3.3 gives an (explicit) isogeny tt : ^ Bj.. So to the modular point 
(^');eZ{fii) may associate the isogeny ft : Bj^ Aj^ and this is the isogeny we 
compute in Step 2 of our algorithm (Section 2.2). 

We have the following diagram 

[^] 

X e > z e Ajf 




This diagram shows that it is possible to obtain an explicit description of the rational 
map z = /t(i/) by eliminating the variables x in the ideal generated by (y = tz{x), 
z = i ■ x). This can be done using a Grobner basis algorithm. In Section 5 gives a much 
faster algorithm which uses the addition formulas in Bj. to find the equations of ft 
directly. 

3.3 Modular correspondences 

In the previous section, we have shown how to compute an isogeny with a prescribed 
kernel K C K2{^)[i] that is isotropic for the commutator pairing. Now let K C Aj.[^] 
be any isotropic subgroup such that we can write K — Ki x K2 with X, C Kj{^). 
Let B)t = A](/K and n be the associated isogeny. Let and ©/i^. be /r-compatible 
theta structures in the sense of Mumford [ jumhh]. We briefly explain this notion: if 
two abelian varieties (Aj., ©Aj.) arid (Bj-,^O/0Bs.) have /r-compatible marked theta 
structures, it means that we have n* {^0) = S£ . By Grothendieck descent theory, this 
define a level subgroup K c G(^) of the kernel of n. We have seen in Section 3.2 
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that we have G(Jfo) = Z{K) / K where Z{K) is the centralizer of K. The structures 
and ©B^ are said to be compatible if they respect this isomorphism. The isogeny 

theorem ([Mum66, Theorem 4]) then gives a way to compute {n* (d- ))/£Z{«) given 

('^i *)/6Z(a)- 

We recall briefly how this works: if Ki = 0, we say that n is an isogeny of type 1, and 
if K2 = that n is an isogeny of type 2. In the paper [ ] we have studied the case 
of isogenics of type 1 and 2; in fact, the notion of compatible isogenics we had defined 
in these cases is nothing but a particular case of the notion of compatible isogenics 
described above. Obviously, by composing isogenics, we only need to study the case 
of compatible theta structures between isogenics of type 1 or 2. We have already seen 
the case of isogenics of type 1 in the previous Section. Now let Jq be the automorphism 
of the Heisenberg group ^{tln) that permutes Z{ln) and Z{£n): 3Q{a,x,y) = {oL,y,x). 
We define = 0^^ o O^o ° where is the automorphism of the Theta group of 
that permutes Ki (.if) and K2 (-5? ) ■ (There is a similar automorphism 3^^ of the theta 
group of B^; we will usually note these automorphisms 3 since the theta group is clear 
from the context.) If TI2 is a compatible isogeny of type 2 between (A^-, Jf, 0^^) and 
{B^,J^Q,@^^), then 712 is a compatible isogeny of type 1 between ( Aj-, .if , o @a^) 
and (Bfc,.if,3BO0Bj. 

Since the action of 3 is given by [FLR09, Section 5] 

we see that we have for all i G Z (n) 

In the following, we focus on isogenics of type 1 but it is easy to adapt the following 
to isogenics of type 2 (and hence more generally to compatible isogenics between theta 
structures) using the action of 3. Considering both types of isogenics can be useful, 
see Section 4.3 or Section 6.3. The modular correspondence described in Section 2.2 is 
given by 

cp : Mj^ ^ MriX Mn, {ai)i^z{In) ^ ((«0/eZ(n)' ( E_ «i+n;)i6Z(«) ) ■ 

/ez{l) 

Let q)i (resp. ^2) be the composition of q> with the first (resp. second) projection. Let 

("0,gz{Zj^) the theta null point of {A, ^, 0^J, and put = ((^0/6Z{l)) ' 

and {Pi)i^z(i) ~ ((^i)i6Z(?)) • Then {bi)j^2(l) theta null point corresponding 

to the variety Bj, = Af,/K2{^)[P\, and (c/),g2(|) corresponds to Q = A^/Ki{^)[C\. 

The following diagram shows that the composition TZ2 o ft : B^ ^ Q is an i'^- 
isogeny: 
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3.4 The action of the theta group on the affine cone and isogenies 

For the rest of the article, we suppose given an abelian variety with a theta structure 
(Bj., =2o, 0B(.) with associated theta null point (t',),gz(n)' ^^'f ^ valid theta null point 
(^');6Z{In) associated to a triple (A/^,^,©^^) such that &B^. and 0^^ are compatible 

[FLR09]. Let ft : Aj, ^ Bi,he the morphism such that Tz*{i3'f'^'') = d^^'' for i E Z{n). 
Note that the isogeny n : A/^ ^ B^- lifts to the affine cone as n. 

Let be the canonical "basis" of Z{£n), and be the canonical 

"basis" of Z{in) so that is the canonical symplectic basis of X(i'M). For 

i e Z{In), we let P; = 0^^ {i,0)) and for i e Z{In) we let Q,- = 0^^, (0,f). The 
points \ Pe , Qf. > form a symplectic basis of for the commutator pairing 

induced by the theta structure: we have for e £j^{Pei,Qfj) = where is the 
Kronecker symbol. 

We have seen (see Section 3.1) that the theta structure ®Ai^ induces a section 
s = sk(^) : JC(if ) G(if ) of the canonical projection k : G(if ) ). The 

kernel of the isogeny tt : A/^ — )• Bj- is 0a^(Z(Z)). Let = s{Kt^) and recall (see 
Section 3.2) that G(^o[ = Z{Kn)/Kn. In particular, we have X(^o) = Z{Kn)/Kn 
where Z{K„) = k[Z{Kji)) is the orthogonal of Kji for the commutator pairing e ^. 
Explicitly, we have: K„ = {Q,},^^^^) and Z{K„) = {P,},ez(H) x {Qil/ezlS) so that 

X(^o) = {/r(P,)},ez{Tf) X ^({Q.},-6Z(a))- 

In the following, if X^- is an abelian variety, we denote by Aut* (Xj.) the group of 
isomorphisms of seen as an algebraic variety, in particular an element of Aut* (Xj.) 
does not necessarily fix the point of Xj.. The action by translation p*r^ : K{J^) 
Aut* induces an action p*^ : K( ) Aut* (B/J via tt: if x e the action of 

Pj^{x) on Bj; is the translation by 7t(x). This action extends the action by translation 
p*j^^ : X(ifo) Aut* (Bfc). We recaU that the action of G(^) on V = T{Aj„^) is given 

by {x,ipx).v = ^p~^T*{v) for {x,ipx) G G(Jf) and G V from which we derive an 
action of G(.if ) on Aj-(V). By restriction, we obtain an action p*^ : G{I£) Aut* (A/t). 
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Similarly, we define an action : G(^o) ~^ Aut* (B^). (Note that n does not induce 

an action from G(^) on B^- via p*y; see Corollary 3.5). Still, we would like to be able 
to recover p*^ from and the theta structure ©b^. First, we have: 

Proposition 3.4: ^ ^ 

Let g e Z{K„)and note gits image in Z{Kji)/ Kn-V^e have p*^^{g) = fcop^[g). 

Proof: This is as an immediate consequence of the fact that the two theta structures 
©Af; and ©Bj, are compatible. ■ 

For g G G{^), we can define a mapping tt^ : Ajt ^ B^^ given on geometric points 
by X i-> Tt{p*^{g).x). If ^ e Z{K„); Proposition 3.4 then shows that fig = p'^^ig) o 
TT, hence fig can be recovered from fz and the theta structure ©g^. Since Z{Kji) D 
s(iiC2(^)), we only have to study the mappings tt; = fis^p^) for f G Z(^m). They are 
given on geometric points by 

Corollary 3.5: 

1. Let S be a subset ofZ{in), such that S + Z{n) = Z{£n). Then x e Aj- is uniquely 
determined by {fti{x)}i^s- 

1. Let y & Aj^be such that ft{y) = fi{x). Then there exists j e Z(Z) c Z{in) such that 
y = {1,0, i).x and 

^iiy) = '^i„{hi)fii{x). 

In particular fti{y) and fii{x) differ by an t^^-root of unity. 

Proof: 

1. Since 7f,((!?y(x)) .^^(a)) = (%^.;(^));ez(«)' from {7f/(x)}.g<j one can obtain the 

values \ > _ . If 5 + Z{n) = Z{in) this shows that we can recover 

I. J ;e5+Z{i!) 

X= (!?/(?))ygz(a)- 

2. If n{y) = n{x}, then pA^iy) — PAki^) G ^n- So there exists; e Z{I) and a e fc* 
such that y = {a,0,i).x. Hence = a.ej^{i,i)'&i{x). Since 7r(x) = 7r(y), 
a = 1. Moreover, as; e Z{I), ej^{i + k,]) = ej^ii,]) Hk E Z{n) so that 7r,(x) = 
e]^{i,i)fiiiy)- ■ 

Example 3.6: 

• If £ is prime to n, the canonical mappings Z{n) Z{£n) and Z(Z) Z{ln) 
induce an isomorphism Zin) x Z(£) — )• Z[£n), and one can take 5 = Z(l) in 
Corollary 3.5. 

• If £ is not prime to n, a possible choice for S is 

S = { J2 e [0..^-!]}. 
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4 The addition relations 

In this section we study the addition relations and introduce the notion of addition 
chain on the affine cone of an abelian variety. This chain addition will be our basic tool 
for our isogenics computation in Section 5 and Velu's like formula in Section 6. 

In Section 4.1 we introduce the concept of extended commutator pairing. The im- 
portance of this pairing comes from the fact that the isogenics we compute with our 
algorithm (see Section 2.2) correspond to subgroups that are isotropic for this extended 
commutator pairing [FLR09]. We explain in Section 7 how to use addition chains to 
compute this pairing. In Section 4.2 we prove in an algebraic setting the Riemann 
relations, and we deduce from them the addition relations. In Section 4.3 we use the 
results of Section 3.4 to study the properties of the addition chain. 

4.1 Evaluation of algebraic theta functions at points of f-torsion 

For the rest of this article, we suppose that we have fixed a Og^ e pg^^(OBj). This 
give us a canonical way to fix an affine lift of 0^^ : we denote 0^^ the unique point in 
PaI ('^A/fc) such that Ogj. = 7r(0yi^). We recall that the theta structure 0^^. gives a section 
^K{j^) '■ ^(-^) ~^ G(^). This means that the map x E K{^) s^_^^{x).Oy{i. G 
Ajt induces a section K{^) — > Ajt of the map : Aj^. We remark that 

the choice of 0^^^ E (0^^^ ) C Aj- is equivalent to the choice of an evaluation 
isomorphism: eq : ^(0) — k. For any x E K(^), let s^(x) = (x, ip^)/ we define 
i?i(x) = eo(s jf{x).i}i) = £o° ° T* (i?,). Then the section K{^) Aj- is given by: 

Thus we have a canonical way to fix an affine lift for any geometric point in X(^). 
For i E Z{Jn), let Pi = (1,/,0).0a;^, and for ; E Z(tn), let Qj = (1,0, y).?)^^ We also 
put Ri = ft{Pi) = 7r,(0^J, and = pB^(R,). We remark that is the kernel 

Kfj; of ft which explains the primordial role the points R; will play for the rest of this 
paper. 

More generally, we can define an affine lift for any point of Bj^ [i] by considering the 
isogeny given by [£] rather than by n: let = [i]*^o on Bj-. As is symmetric, we 
have that [Mum70] and so K{^o),t'he kernel of is isomorphic to K{fin). 

Let 0Bj.,.^o ^ theta structure on (Bjt, compatible with the theta structure ©g^ 

on (Bj-, ^q). We note Bj- the affine cone of (B/^, ^o), and [i] the morphism B/^ B/^ 
induced by [£] . 

We recall that there is a natural action of G(^o) on H^{^q) which can be trans- 
ported via @Bt,^n to an action oi'H{P-n) on H^{^q). We note 0~/ the affine lift of the 

theta null point of Bj- such that [^]0~' = Og^. We can then generalize the definition of 
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the R, by looking at the points: 

Let H = E Z(I)}. H is a commutative subgroup of ^-[{f-n) such that 

[(]xi = [£]x2 if and only if xi = h.X2 where h E H. We see that the section of a point 
in Bjt [£] is only defined up to an £"'-root of unity (This is also the case for the lift Rj 
of Rf. if we change the theta structure on Aj., it changes the R, by an ^^''-root of unity. 
See also Corollary 3.5 and Example 6.8). The geometric meaning of these affine lifts is 
explained in Section 6.2. 

The polarization induces a commutator pairing e ([Mum6^ ]) on and 
as ^0 descends to I£q via the isogeny we know that e^^^ is trivial on Bj-[^]. For 
X\,X2 G Bj.[i?], let Xj,X2 G be such that i.x\ = x,- for i = 1,2. We remark that 

x[ and Xj are defined up to an element of Bi^[£]. As a consequence, e_^g(x^,X2) = 
e {x\, X2) = {x'y x'jY, does not depend on the choice of x'^ and Xj and if we put 
e^(xi,X2) = e ^g{x[, X2), we obtain a well defined bilinear application : Bjt[£M] x 
Bj^[£n] k. We call the extended commutator pairing. It extends the commutator 
pairing since ii x,y E B/Jn] we have e'f,{x,y) = e^^{x,y)^. When we speak of 
isotropic points in Bj.[£], we always refer to isotropic points with respect to e^. We 
quote the following important result from [FLR09]: the modular points cp^^ (^/)igz(«) 
that we compute in Section 2.2 correspond to isogenics whose kernel are isotropic for 
e't 

4.2 The general Riemann relations 

The Riemann relations (2) for and the Riemann equations (4) for A^- are all 

particular case of more general Riemann relations, which we will use to get the addition 
relations on Aj^. An analytic proof of these relations can be found in [Mum83]. 

Theorem 4.1 (Generalized Riemann Relations): 

Let xi,yi,ui,vi,z E Ai^ be such that xi + 1/1 + mi + ci = 2z. Let X2 = z — xi, 1/2 = z — 1/1, 
M2 = z — Ml and V2 = z — vi. Then there exist x\ E p^^(xi), yi E "i £ 

vi E V^^i^i)' ^2 e p^^{xi), yi E V^^iyi)' "2 e P'a^{u2), V2 E V'^aS^i) that satisfy the 
folloiving relations: for any i, j, k,l,m E Z {In) such that i + j + k + I = 2m, let i' = m — i, 
f = m— i,k' = m — k and V = m — I, then for all x. G Z(2), we have 

( E xm+t{xi)i)j+t{yi)).{ E x{m+t{ui)^i+t{vi)) = 

( E Xm'+t{x2)&f+t{y2))\ E X{i)&V+l{ui)&V+t{v2)). (8) 

tez(2) fez(2) 

Proof. Ifx = i/ = M = c = 0^, the preceding result gives the algebraic Riemann 
relations, a proof of these relations can be found in [ \4um66]. We just need to adapt 
the proof of Mumford for the general case. 
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Let pi and p2 be the first and second projections from Aj^ x Aj. to A;.. Let = 
pi* (^) p2* The theta structure induces a theta structure &Ai,xAi, such that 

for e Z(in) x Z(ln) we have !?®^^'^ = «) i?®'*^ (see [Mum66, Lemma 1 
p. 323].) Consider the isogeny ^ : Aj- x Aj- ^ Aj- x A^-, (x, y) i-> (x + y, x — y). We 
have ^* (^) = Since 0^^. is a symmetric theta structure ©^j, it induces a theta 
structure on and on 

.^2. One can check that this theta structure is compatible 
with the isogeny ^. Applying the isogeny theorem (see [Mum6(' , p324]), we obtain that 
there exists A Ek* such that for all i,] E Z{ln) and x,y E Aj^(k): 

{df ® ^fmx,y)) = A ^_ {^f ® ^f)ix,y) (9) 

u,veZ{2ln) 
u+v=i 
u—v=j 

In the preceding equation, in order to evaluate the sections of ^ or at a geo- 
metric point of X E X A]( we just choose any isomorphism between or ^^id 
^A;^xAf:,x where ^a^-xAj is the structural sheaf of A/^ x Aj^. To simplify the notations, 
we suppose in the following that A = L 

Using equation (9) we compute for all i,] E Z{2£n) which are congruent modulo 
Z{£n) and x,y E Aj.(fc): 

fGZ(2) tez(2)_ 

u,veZ{2ln) 
u+v=i+j+t 
u—v=i—j+t 

= E X{ti + t2)^^l{x)dff^{y) 

h,t2&Z{2) 

E x{t)^^]{x)] ■ I E xit)^ffiy) 

V*ez(2) / \tez{2) 

So we have: 

( E x{t)^^j+t{^ + y)^j^j+t{x-y)).{ E xit)^f+i+t{u + v)^f_,+,{u-v)) = 

fez(2) tez{2) 

( E E A(0'9j?:(y))-( E E aWC(^)) = 

tGZ{2) t6Z(2) t6Z(2) '62(2) 

( E + E xit)^f+j+tiu + y)^f-j+t{u-y)) 

teZ{2) t<^2(2) 

(10) 

Now if we let x = xq + yQ,y = xq — yo, u = mq + vq and c = wg ~ ^0/ we have 
X + y + u + V = 2{xq + uq) so we can choose z = xq + uq, so that z — x = uq — yo, 
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z — y = uq + yQ, z — u = xq — vq, z — V = xq + vq. "By doing the same variable change 
for k, I we see that the theorem is just a restatement of Equation (10). (see [Mum66, 
p334]). ■ 

From the generaUzed Riemann relations it is possible to derive addition relations. 
First remark that since the theta structure 0/^^^ is symmetric there exists a constant 

A e fc* such that for all i e Z{in), di{—x) = X.d^i{x). In particular if x e A/^, we put 

Theorem 4.2 (Addition Formulas): 

Let x,y E Aj({k) and suppose that we are given x e (x), y e (y), x — y E p^^ (x — 

y), then there is a unique point x + y E Ai^{k) verifying for i,i,k, I E Z{in) 
t€Z{2) fez(2) 

( E x{t)^-i'+tim'+t(y))-( E xm'+tim'+t{x)), (h) 

teZ(2) f6Z(2) 

and we have p^^ (x+y) = x + y. 

Thus the addition law on Aj^ extends to a pseudo addition law on A^; we call it an addition 
chain and we note x + y = chaine_add(x, y,x — y). 

Proof. We apply the Riemann relations (8) to x + y, x — y, 0^^, 0^. We have 2x = (x + 
y) + (x — y) + Oa + 0/1, — y = X — (x + y), y = X — (x — y), X = X — 0^, x = x — 0^^ 
so Theorem 4.1 shows that there exist a point x + y E Aj^{k) satisfying the addition 
relations (11). 

It remains to show that this point is unique. But first we reformulate the addition 
formulas (see [Mum66, p334]). Let H = Z(Zn) x Z(2), and for {i,x) E H define 

hxi^) = E_ X{t)^i+tix). 
tez{2) 

Then we have for all i, i,k,l,m E H such that 2m = i + j + k + I 

Ui{x + y)uj{x^y)uk{OA^)ui{OA^) = 

(x)w„_,+^(x) (12) 

?eH,2f=6Z(2)xO 

It is easy to see that (i?, i^)ii^z{7n)' determined by (m, {x))i^H- That means there is a 
i E H such that Uj{x — y) 7^ otherwise we would have di[x —y) =0 for all i E Z{£n). 
Now for all i E H, we need to find k,l E H such that i + j + k + I =2m and mj; (0) 7^ 0, 
M;(0) 7^ 0. In that case equation (12) allows us to compute W/(x + y)uj{x — y)fi'j.(0)M;(0) 
from (m, (x)),£h and {ui{y))i(zHf so we can obtain m,(x + y). 
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In [Mum66, p. 339], Mumford prove that for any / G H, there is an a £ 2Z{in) such 
that 0) (0) 7^ 0- So we can choose k = i,l = j, we have + / = 2m, and if 

necessary we add an element of 2Z (£n) to A: and Z. ■ 

Algorithm 4.3 (Addition chain): 

Input X, y and such that p^^ (x) - p^^ (y) = p^^ (x^) ■ 
Output X + y = chaine_add(x,y,x — y). 

Step 1 For all i E Z{ln), x & Z.{2) and X E {x + y, x,y,Oy^^} compute 

"/,;c(X)= E Xm+t{X). 
fez(2) 

Step 2 For all i e Z {(.n) choose k,l E Z {In) such that i+j + k + l = 2m, uj (x — y) 7^ 
0, M/c(O^J 7^ 0, M;(O^J 7^ and compute 

M,-(x + y) 



2^Suj{x-y)uj,{0A,)uii0A,) 

{y)u„_^+^{x)u„_i+^{x). (13) 



feH,2f=eZ(2)xO 
Step 3 For all i G Z(^m) output 



?,-(x+y) = 2^ E_ + 

?6Z(2) 



Complexity Analysis 4.4: 

We use a linear transformation between the !? coordinates and the u coordinates in the 
Steps 1 and 3 because we have seen in the proof of Theorem 4.2 that the latter are more 
suited for additions. 

As M/+f,;(; = x(0"f,x only need to consider {in)S coordinates and the linear 
transformation between u and d can be computed at the cost of {2nlY additions in k. 
We also have m,^^(— x) = m_,-^^(x). 

Using the fact that for t G Z(2) the right hand terms of (13) corresponding to 
f = (^1 + t, ^2) and to f = (^1, ^2) are the same up to a sign, one can compute the 
left hand side of (13) with 4 ■ 4^ multiplications and 4^ additions in k. In total one can 
compute an addition chain in A.{AinY multiplications, {Aln)S additions and (InY 
divisions in k. We remark that in order to compute several additions using the same 
point, there is no need to convert back to the d at each step so we only need to perform 
Step 2. 

The addition chain formula is a basic step for our isogenics computations, and in the 
sequel we consider it as our basic unit for the complexity analysis. In some cases it is 
possible to greatly speed up this computation. See for instance [Cau07] which uses the 
duplication formula between theta functions to speed up the addition chain of level 
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two (in genus 1 and 2). See also Section 5.1 where it is explained how to use isogenies 
to compute the addition chain for a general level by using only addition chains of level 
two, so that we can use the speed up of [Gau07] in every level. 

Remark 4.5: 

The addition formulas can also be used to compute the usual addition law in Aj. by 
choosing / = in Equation (13) for every /. 

It is also possible to use directly the coordinates as follows: if x,y e Ai^(k) and 
i e Z (£m), for every ;t G Z (2), one can choose k,l & Z {£n) such that i + k + lis divisible 
by 2 and 

t6Z(2) 

So one can use (11) to compute 

E xm+t{P + Q)^o+t{P-Q)), 
fez(2) 

I 

and recover i?,- (P + Q) by inversing a matrix. For instance we have i?,- (x) = — ^ '^x,''^ 

The addition chain law on A^- induces a multiplication by a scalar law which re- 
duces via pyij^ to the usual multiplication by a scalar law deduced from the group 

structure of A]^. Let x,y E Aj^ and x + y E p^^ {x +y), then we can compute 2x + y : = 

chaine_add(x + y,x,y). More generally there is a recursive algorithm to compute for 
every m ^ 2: 

mx + y := chaine_add((?w — \)x + y,x, (m — 2)x + y) 

We put chaine_multadd(n, X -|-y, x,y) := mx + y and define chaine_mult(OT, x) : = 
chaine_multadd(m,x, x,Oy^^). We have p^^(chaine_mult(;«,x)) = m.pA^{x). We call 
chaine_multadd a multiplication chain. 

Algorithm 4.6 (Multiplication chain): 

Input m E N, X + y, X, y E A/^ . 

Output chaine_multadd(wz, X + y,x,y). 

Step 1 Compute the binary decomposition of m := EjLo Set m' := 0, xyg := y, 

xy_]^ := chaine_add(y, — x, x + y), xg := O^j^ ^rid xj := x. 
Step 2 For i in [L.O] do 

If hi = then compute 

X2„,' := chaine_add(x„/,x,„/,xo) 
X2m'+i chaine_add(x„/^X'^m''^l) 
^Jlm' ■= chaine_add(xy„,,x„,,,,xyo) 
m' := 2m'. 
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Else compute 

X2m'+i chaine_add(x„/^X'^m''^l) 
^2m'+2 '■= chaine_add(xm/^i,x,„/^i,xo) 
^Y2m'+1 ■= chaine_add(xy„,,x„,,,xy_i) 
m' := 2m' + 1. 

Step 3 Output xy„,. <0> 

Correction and Complexity Analysis 4.7: 

In Corollary 4.13 we show that multiplication chains are associative, so we can use a 
Lucas sequence to compute them. In order to do as few division as possible, we use a 
Montgomery ladder for our Lucas sequence, hence the algorithm. 

We see that a multiplication chain requires 0(log(m)) addition chains. <0 

Lemma 4.8: 

For Xx, ^y, ^x-y £ ^ iind x,y & Aj.(A'), we have: 

- ^ ^ . 

chaine_add(Aj;X, Ayi/, Ajc-yX — y) = - — - chaine_add(x, y,x — y), (14) 

,n(n-l) ,„ 

chaine_multadd(n, Aj:+yX + y, A^x, Ayy) = — r — ^ chaine_multadd(M, x + y, x,i/), 

Al! 



(15) 



.,2 



chaine_mult(w, A^x) = A" chaine_mult(w,x). (16) 



Proof: Formula (14) is an immediate consequence of the addition formulas (11). The 
rest of the lemma follows by an easy recursion. ■ 

4.2.1 The case n = 2 

Let X be the generic point of Aj;. Then the Riemann equations (17) come from the 
following addition formula: 

X = chaine_add(x,0/i,x). (17) 

We suppose here that n = 2 and I = \. We have for all i e Z(2), ( — 1)*!?/ = !?,■, where 
( — 1) is the inverse automorphism on Aj^. As a consequence, ^ gives an embedding 
of the Kummer variety K/{ = A/ zLl. The equations (17) are trivial, so that Riemann 
equations does not give the projective equations of this embedding (except when 
g = 1). Nonetheless, one can recover these equations by considering more general 
addition relations. 
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Let p : Ajt ^ -Ka be the natural projection. If x,y G K/^, let xq € p ^(x) and j/o = 
p-i(y),wehavep(p-i(x) + p-i(y)) = p(±xo + ±yo) = {p(^o + yo). p(^0 - J/o)}- As 
a consequence, there is no properly defined addition law on Kj^: from ±x G and 
±y G X^, we may compute ±x ± y which give two points on X^. However, if we 
are also given ±(x — y) e X^, then we can identify ±(x + y) e {±x ± y}. Thus the 
addition chain law from Theorem 4.2 extends to a pseudo addition on the Kummer 
variety. We remark that our addition chain is a generalization of the pseudo addition 
law on the Kummer variety. 

Let X, y G X/i^. To compute ±x ± y without ± (x — y ) we can proceed as follows: let 
X = (^i),ez{2)' ~ (^!)!gz(2) '■^^ projections of the generic point on x K^. 

Then the addition relations chaine_add(X, x, y, Y) describe a system of degree 2 in 
X^ X K/{, whose solutions are (±(x + y), ±(x — y)) and (±(x — y), ±(x + y)). From 
this system, it is easy to recover the points {±(x + y), ±(x — y)}, but this involves a 
square root in k. (The preceding claims will be proved on an upcoming paper). Coming 
back to isogenics computations, it means that when working with n = 2, we have to 
avoid computing normal additions, since they require a square root and are much 
slower than addition chains. 

We make a last remark concerning additions on the Kummer variety. Suppose 
that we are given x,y,z e K/^, together with ±(x + y), ±(y + z). We want to find 
±(x + z). Using the addition relations, we can compute S = {±(x + z), ±(x — z)}. 
Let A E S, then the solutions of the addition relations chaine_add(X, x + y. A, Y) are 
{±(2x + y + z),±(y-z)} if A = ±(x + z), and {±(2x + y - z), ±(y + z)} if A = 
±(x -z). This allows to find ±(y + z) € S if 2x 7^ 0,2y 7^ 0,2z 7^ 0,2(x + y + z) / 0. 
We call this the compatible addition relation, and we can use this to compute ±(x + z) 
directly without taking a square root (by computing the gcd between the two systems 
of degree two given by the addition relations). 

4.3 Theta group and addition relations 

In this Section, we study the action of the theta group on the addition relations. We 
use this action to find the addition relations linking the coordinates of the points 
{Ri}iizZ({n)' considering different isogenics tt : A/t ^ Bj^, we can then understand 
the addition chains between any isotropic subgroup of B)([£] (see Section 4.1). In 
particular we exploit this to show that we can compute the chain multiplication by £ 
in 0(log(^)) addition chains. 

Lemma 4.9: 

Suppose that xi, yj, ui, vi, X2, y2, "2/ ^2 G ^jt satisfy the general Riemann relations (8). 

• For every g E G(^), g-Xi, g.yi, g.ui, g.vi, g.X2, g.yir g-U2, g-V2 also satisfy the Rie- 
mann relations. 

• For every isogeny n : [A, J^, ) ^ (B, ®Bf, ) such that ©b^ is n-compatible of 
type 1 with 0^^, then 7r(xi), fz{y-[), 7r(Mi), n:{v-[), 7r(x2), 7? (y2), 7t(m2), tz{v2) E Bj^ 
also satisfy the Riemann relations. 
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Proof: This is an immediate computation. ■ 
Lemma 4.10: 

Let {oc,i,i) e T-Litn). Let x = (a, f,y).OAj. G Aj-. Then we have —x = (a, —i, — y).OA,^. 
More generally, ifxe Aj^, then — (a, i,i).x = {a, —i, —j). — x, and we have tt (— x) = 

— TT (x). 

Proof: If X = (^/)/(EZ(Zn)' recall that we have defined —x = {x~i)i^z{In)- 

= («i),-6Z(a)'if " S Z(^n) wehaveby(3):x„ = {{ci,i,i)^A^)u = aji-u - i)au+i, 

((a, -f, -7).0aJ-w = «(-;■)(" + 0«-«-i = = 
The generalization and the rest of the lemma is trivial. ■ 

An interesting property of the addition formulas, is that they are compatible with 
the action Sf^^^^j^^ : Ki{^) — )• Aj^: 

Proposition 4.11 (Compatibility of the pseudo-addition law): 

For x,y,x — y e A^, and i,j e Z(£n), we have: 

(1, chaine_add(x,y,x — J/) = chaine_add((l,f,0).x, (l,y,0).y, (1,/ — y,0).x — y) 

(18) 

In particular if we set Pi = (1, i, 0).0^|, we have: 

Pj^j = chaine_add(P,', 



Proof: Letx + y = chaine_add(x,i/,x — y). By Theorem 4. 2, we have for every a, 27,c,d,e e 
Z{In) such that a + b + c + d = 2e: 



( E ;^(Oi?«+t(^+y)t?;,+t(f^)).( E x(0'?c:+f(o)!9<i+t(o)) = 

t6Z(2) fez(2) 

( E ^(f)'?-.+«+t(y)!?.-b+f(y))-( E x(0'?.-c+f(?)!?.-d+f(^))- (i9) 

teZ(2) f6Z(2) 

Applying (19) to a' = a + f + /, i^' = ^7 + f — j, c' = c,d' = d,e' = e + i, it comes: 

i+j+a+t 

tGZ{2) t6Z{2) 

( E X{t)^-j-e+a+t{y)^j+e-b{y))-{ E A:(0!?/+.-c+t(^!9/+.-d+t(^)) ■ (20) 
teZ(2) f6Z(2) 

Thus (1, f +/,0).x + 1/, (l,f,0).x, (l,y,0).yand (l,f — /,0).x — y satisfy the additions 
relations. ■ 
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By applying n, we obtain the following corollary: 
Corollary 4.12: 

7f/^;(chaine_add(x,y,x — i/)) = chaine_add(7f,(x), ftj{y), 7f,_,(x — y)) 



Proof: Remember that by definition 7r, (x) = 7r((l, i,0).x). The lemma is then a trivial 
consequence of Proposition 4. 1 1 and Lemma 4.9. ■ 

We discuss two consequences of the preceding corollary. The first is that we can 
recover the point X = ('^i(^)),ez(Z«) from only a subset of its coordinates i(zz(E) 
(see Section 5.1). 

The second application is the computation of the dual isogeny ft (see Section 5.2). 
But first we remark that by setting x = y = O/i^ in Corollary 4.12, we find 

= chaine_add(_R/, _Ry,_R,_y). 

By considering different isogenics n : Aj^ ^ B/t, we can use Corollary 4.12 to study the 
associativity of chain additions: 

Corollary 4.13: 

Let X e B^- [£] and y e Bj.. Choose any affine lifts x, y and x + y of respectively x, y and x + y. 

1. Letnx + y = chaine_nmltadd(n, x + i/,x,y) and nx = chaine_mult(M, x). 
We have 

(mi + n2)x + y = chaine_add(MiX + y, n^x, (ni — n2)x + y) (21) 

In particular, we see that we can compute nx + y in 0(log(n)) addition chains by using 
a Montgomery ladder [CFA^'06, alg. 9.5]. 

2. —nx + y = chaine_add(n, — (x + y), —x, —y) 

Proof: We prove the two assertions. 

1. Let K be a maximal isotropic group containing x, and let Aj^ = Bj^/ K. Let tt : 
Ajf Bi^ be the contragredient isogeny, and choose any theta structure on 
(Ajt, 7r*^o) compatible with n. There exist i e Z(l) and A,- e k* such that 
X — A/7f/(0^^). If A, = 1, then Corollary 4.13 is a consequence of Corollary 4.12. 
But it is easy (see Lemma 4.8) to see that (21) is homogeneous in A,, hence the 
result. 
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2. Once again, let i e Z{i) be such that x = XjK \ i,0).QA^j, and let y' be any 
point in 7r~^(y). By homogeneity we may suppose that A, = 1. By Corol- 
lary 4.12 and Proposition 4.11, we have nx + y = fi{{l,n.i,Q).y'). Now by 
Lemma 4.10, we have —nx + y = n {—{l,n.i,0).y') = n ({1, —n.i,0). — y') = 
chaine_add(n, — (x + y), — X, — y). ■ 

We make a last remark concerning Corollary 4.12 namely a useful fact for studying 
the case £ not prime to n: 

Remark 4.14: 

Let X e Aj-, i e Z(£n) and let y = tz{x). Let m & Z such that £\m. By Proposition 4.11 
and Corollary 4.12, we have 

TZ {{l,mi,0).x) = chaine_multadd(OT, 7f,(x),_R,-,y) 

But if £\ni, then mi e Z{n) c Z{£n), by Proposition 3.4 we have ft {{l,mi,0).x) = 
(1, m/,0).y, and {l,nii,0).y can be computed with the formulas (3). Hence 

{l,mi,0).y = chaine_inultadd(m, ;f,(x),_R/,y) 

For the purpose of Section 6.2, we have to study the addition relations between the 
points in Bi^[£] which does not necessarily belong to K(Jfo). From Section 4.1, we see 
that we need to understand the link between the addition relations and the isogeny 

[£] . More generally, for the rest of this section we will study the relationship between 
the addition relations and a general isogeny. First we take a closer look at the action 
of (^) on the addition relations. Let 3 be the automorphism of the Theta group 
from Section 3.3 that permutes Ki and K2- Since Sj(2{if) = 3 ° ^Ki(^) ° 
suffices to study the action of 3 on the addition relations. 

Proposition 4.15: 

Suppose that x, y, u, v, x', y', u', v' G Aj. satisfy the general Riemann equations (8). Then 3.x, 
3.y, 3.U, 3.V, 3.x' , 3.y', 3.u', 3.v' also satisfy (8). 

Proof If X = (^/),GZ(ln) recall (see (7)) that 

3.x = ( ^{^'i)^j)iez{ln) 

where e = is the commutator pairing. 

By hypothesis, we have for i,i,k, I e Z{in) such that i + j + k + 1 = 2m: 

( ^ !9,+fWV(3/))-( E h+t{u)^l+t{v)) = 
tez{2) tez(2) 

( Y: ^r'+t{^'¥f+t{y'))-{ E h'+t{u')^V+t{v'))- (22) 
teZ(2) t6Z(2) 
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Let = (Efez(2)^(0%fW'^;+f(y))-'^ehaveif J,/,J<:,L G Z(^n) are such 

that J + / + X + L = 2M: 

Tez(2) /ez(^)i) ;ez(£«) 

E _x{T)e{T,i + j)e{I,i)ei},i)Mx)My) 

T€Z{2),i,j€Z{en) 



E ;t(Ti + T2MTi,i+/>(T2,/c + /MJ,z>(/,/>(X,fc)e(L,Z)i?,(x)i?y(y)z?;t(w)'?/(^) 

Ti,T2eZ(2) 
!,;,WeZ(^n) 

= ^ _ e{l,i)e{J,j)e{K,k)e{L,l)di{x)dj{y)d^{umv) 

i,j,k,leZ(en) 

( E ;i(ri + r2)e(Ti,/+;>(T2,fc + 0) 

Ti,T2eZ(2) 



But 



4^ ife(-,i+;) =e(-,fc + /) =;C 
otherwise 



( E x{Ti + T2)e{T,,i + j)e{T2,k + l))^ 

Ti,T2eZ(2) 

and e{-, i+ j) — e{-,k + l) (as characters on Z(2)) iff there exists m € Z(£m) such that 
i + i + k + l ^Im. Now since J + / + J<: + L = 2Mwe have e(I + /, •) = e(J<: + L, •) so 
we have: 

A i + ^MJ'i + h)e{K, k + t2)e{L, I + t2)^i+t, {x)dj+t, {y)^k+t2 {u)^l+t2 (^) 

fi,t2ez(2) 

\e{I,i)e{],i)e{K,k)e{L,l) ^ d,^t^{x)dj+t^{y)d,^t^{u)di+t^{v) = 

h,t2GZ(2) 

\e{I,i)e{},j)e{K,k)e{L,l) ^ i?i'+ti(^')'?f+ti(y')'?fc'+f2("')'?/'+t2(^) = 

ti,j2ez(2) 

\e{l',i')e{r,f)e{K',k')e{L',l') #,+,^(x')t?;V+t,(y')%+f2("')'?/'+f2(^) 

fi,f2ez(2) 

where K — ^ it i + j + k + 1 — Im and A = otherwise. By combining these relations 
we find that 

Ax,'3.x,'3.y,l,]A^,'3.u,'3.v,K,h = ^xP-x' P-y' ,1' \,'3.u',3.v',K,L 

which concludes the proof. (We remark that we did not need to use the general 
Riemann relations with characters on our proof. By considering 3o3, this shows that 
the general Riemann relations with characters are induced by the general Riemann 
relations without characters.) ■ 
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Corollary 4.16j^ 

Let x,y,x — y e Aj-, and let i,] e Z{(.n), k, I e Z{in). Then we have: 

i,k + l). chaine_add(x,y,x — y) = chaine_add((l,;,A:).x, {!,], l).y, i,k — l). 

Proof: By Propositions 4.11 and 4.15 we have 

S2(A: + /). chaine_add(x,y,x — y) = chaine_add(s2(A:).x, S2(Z).y, S2(A: — Z).x — y) (23) 
Now since {l,i,k) = Si(f)s2(A:), we conclude by combining Equations (18) and (23). ■ 
Corollary 4.17: 

Suppose that xi,yi, u\, v\, xi, y2, ui/ ^2 & -^k satisfy the Riemann relations (8). 

If Tz : {A, J£ , ®Ai, ) ^ (S, -5^0/ ©Bj. ) 2S an isogeny such that ©g^ is n-compatible with &a^> 
then ft{xi), ft{yi), n{ui), Ti{vi), ft{x2), Ti{]fi), 7i{u2), 7z{v2) S Bj^ also satisfy the general 
Riemann Relations. 

In particular we have 

7f(chaine_add(x,y, X — y) = chaine_add(7f (x), fc{y), n{x — y)) 

Proof: By Lemma 4.9, this is the case for compatible isogenies of type 1. By Proposi- 
tion 4.15 this is also the case for compatible isogenies of type 2, which concludes since 
every compatible isogeny is a composition of isogenies of type 1 or 2. ■ 

5 Application of the addition relations to isogenies 

In this Section we apply the results of Section 4 to the computation of isogenies 
(see Section 5.2). More precisely, we present an algorithm to compute the isogeny 
71 : Bj- Aj- from the knowledge of the modular point 0^^^. We give in Section 6 
algorithms to compute from the kernel of ft. 

Since the embedding of Aj- that we consider is given by a theta structure of level tn, 
a point 7r(x) is given by {in)S coordinates, which get impractical when I is high. In 
order to mitigate this problem, in Section 5.1, we give a point compression algorithm 
such that the number of coordinates of a compressed point does not depend on I. 

We recall that we have chosen in Section 4.1 Oyi^ = (fl,)-g2(|^) thus that 7r(0yi^) = Og^, 

and that we have defined for / e Z(£m) Ri = (fli+;)yez(H)- 
5.1 Point compression 

Suppose that ^ is prime to n. We know that x e A^- can be recovered from {^i{^))i^z(j.)' 
by {x)„i^£j = {nj{x))j. If (dj, ■ ■ ■ ,dg) is a basis of Z(Z), we can prove that x can be 
easily computed from just (7r^;(i')),g[i..j] and (7rd;+dy(^))/,;6[i..g])- ('^i' ' ' ' ''^g) is the 
canonical basis of Z{in), in the following, we take as a basis of Z(£) the d, = ne; if 
i e [l..g]. 
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Proposition 5.1: 

7Zi^j{x) = chaine_add(7f,(x),_Ry, 7r/_y(x)). 

Proof: We apply Corollary 4.12 withy = 0^^,x — y = x, so that we have chaine_add(x,y, 
X. We obtain: 

TCi+j{x) = chaine_add(7f/(x), TZj{OA^), 7f,_y(x)). ■ 

Definition 5.2: 

Let S C G be a subset of a finite abelian group G such that Og G S. We note S' the 
inductive subset of G defined by S' = S\J{x +y\x e S',y e S',x — y e S'}. We say 
that S is a chain basis of G if S' = G. 

Example 5.3: 

Let G = •Z(Z). Let {ei, ■ ■ ■ ,eg} be the canonical basis of G. There are two cases to 
consider to get a chain basis of G: 

• If £ is odd, then one can take 

S = {Og/ + e/}/,;G[l.. g],i<; 

• If ^ is even, we use 

S = {OG,e;i,e,i +e,2,- ■ ■ ,e,i + ■ ■ ■ + eig}i,,- ,ige[i..g],i,<-<ig 

In each case, the chain basis S is minimal, we call it the canonical chain basis 6(G) of 
G. 

We recall that we have defined a section S C Z [In) of Z [in) Z (n) in Example 3.6. 
To this set we associate a canonical chain basis © C 5 as follow: if I is prime to n, then 
S = Z(Z) c Z(Zn), and we define © = ©(Z(Z)) = {di,- ■ ■ ,dg,di+dg,-- ■ ,dg-i + 
d^}. Otherwise we will take © = @{Z{£n)). 

Theorem 5.4 (Point compression): 

Let X e A^. Then xis uniquely determined by O/i^ and {/fi(x)},ge. 

0/^l^ is uniquely determined by {7f,(0A^)},£6 = {^/j/ee- 

Proof By Proposition 4. 11 we have 7f/^y (x) = chaine_add(7T, (x), 71^(0^^.), 7T/_j(x),0Bj.). 
So by induction, from {7fj(x)},ge we can compute every {7T/(x)};ge/. Since & = S 
(or contains iS if n is not prime to E), Corollary 3.5 shows that x is entirely determined 

by {7r,(x)},ge and {7r,(0Aj}iee- 

In particular, 0^^ is entirely determined by {^/(Oa^^) • ^/(Oaj.) = ^{Pi)- by 
Proposition 3.4 which concludes. ■ 
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In the description of the algorithms, we suppose that i is prime to n, so that S = 

Z(l) c Z{Jn). 

Algorithm 5.5 (Point compression): 

Input x= {H^))i^z{B) £ ^-t 

Output The compressed coordinates (7r;(x));ge. 

Step 1 For each i e 6, output (7f,-(x)) = {'&ni+lj{x))j^z{n) 

Algorithm 5.6 (Point decompression): 

Input The compressed coordinates 7r(x),ge of x. 

Ouput X = {M^))i(.Z{In) S ^-t- 

Step 1 Set 5' := 6. 

Step 2 While S' ^ S, choose i,] E S' such that i + j E S \S' andi - j E S' . 
Compute 7f,_|_^(x) = chaine_add(7r;(x),_Ry, 7r,_y(x)). 
S' ■.= S'[j{i+i}- 

Step 3 For all i E Z{£n), write f = nio + £] and output = (7T/(,(x))^.. 

Correction and Complexity Analysis 5.7: 

By using repeatedly the formula from Proposition 4.11: 

7Ti^j[x) = chaine_add(7r,(x), _R^, 7T;_j(x), Ogj.) 

we can reconstitute every 7f,(x) for i E Z(Z) in Step 2 since 6 is a chain basis of 
Z (i) . We can then trivially recover the coordinates of x in Step 3 since they are just a 
permutation of the coordinates of the {7T/(x), i E Z(l)} (see Section 3.5). 

To recover x, we need to do #5 — #6 = 0{£S) chain additions. The compressed 
point {fti{x)}i^Q is given by #6 x coordinates. 

lf£n = Iuq and mq is odd we see that we can store a point in A^- with 2^? (1 + g{g + 1) /2) 
coordinates (4^ if uq is even) rather than {2nQ)S. 

5.1.1 Addition chains with compressed coordinates 

Letx,y andx — yE Aj-. Suppose that we have the compressed coordinates {7f,(x)}/£e, 
{^!(y)}/eS/ {^/(^ ~ !/)}i6e- Then if f E 6 we have by Corollary 4.12 

7f/(x + y) = chaine_add(7f, (x), 7To(y)/ ^/(^ ~ !/)/ 

hence we may recover the compressed coordinates of x + y. 

We can compare this with an addition chain with the full coordinates (of level In). 
By the formulas from Theorem 4.2, since 2\n and the formulas sum over points of 
2-torsion, we see that we are doing #5 addition chains in B]^ of level n. This mean 
that we are doing the same addition chains in Bj- when we use a chain addition with 
compressed coordinates and then use the point decompression algorithm. But if we just 
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need the compressed coordinates, the chain additions with compressed coordinates 
are much faster since we need to do only #& addition chains of level n. In particular, 
since we can compute the multiplication by m with chain additions, we see that the 
cost of a multiplication by m is 0(#(3 log(;«) ) addition chains of level n. 

Since we can take n = 2, this mean that the additions formulas of level 2 allows us 
to compute addition chains of any level. In particular the speed up for these formulas 
given by [Gau07] affects all levels. 

5.2 Computing the dual isogeny 

We recall that we have the following diagram: 

X e Aj, — z e Aj, 




Let y e Ps^iy) ^"^^ X e Ajt be such that n{x) = y. Let i e Z(£). In this 
section, we describe an algorithm to compute fzj^i.x). By using this algorithm for 
i E {di, ■ ■ ■ ,dg,di + d2, ■ ■ ■ dg-^i + dg}, we can then recover ft{y) = p^^(^.x) (see 
Theorem 5.4, g] is the basis of Z(i) defined in Section 5.1). We know that 

ni{x) = y + Ri- For i e Z(£), we choose a point n"{x) e (y + _R,) so that for each 

i e Z(Z) there exists A,- e fc* such that 7r,(x) = A,7r?(x). If x' is another point in 7r~^(y), 
then we have 7f, (x') = A^7r"(x), with A'- = ^A,-, ^ a l-mot of unity. As a consequence, it 
is possible to recover A, only up to an ^'''-root of unity, but this information is sufficient 
to compute 7f, (^.x): 

Theorem 5.8: 

For alii e Z(Z), 

fzj{£.x) = X\ chaine_multadd(£, 7r"(x),y, _R,)), 
where X\ is determined by: 

y = X\ chaine_niultadd(£, n"{x),Ri,y). 

Proof: By Proposition 4.11 and Lemma 4.8 we have: 

fzi{£.x) = chaine_multadd(£, 7T,(x), 7r(x), 7r(P,)) = \f chaine_multadd(^, 7r"(x),y, _R,). 

Now we only need to find the Xf for i E Z(£). But by Proposition 4.11 and an easy 
recursion, we have x = Sj^^^^^ (f)'^.x so that by Corollary 4.12 and Lemma 4.8 

7t{x) = chaine_multadd(£, 7r/(x),_R/,y) = Af. chaine_multadd(^, 7r"(x),_R;,y) ■ 
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Algorithm 5.9 (The image of a point by the isogeny): 
Input y e Bjt- 

Output The compressed coordinates of 7t(i/) E A]^. 

Step 1 For each i G (3 compute y + and choose an affine lift y, of y + R,. 
Step 2 For each f G (3, compute ylR; := chaine_multadd(£, y/, _Rj,yo) and A; such 
that yo = A/ylRj. 

Step 3 For each i G (3, compute 7r(7t(yo)); = A,- chaine_multadd(£,y;,y, _R,)). 

Correction and Complexity Analysis 5.10: 

In Step 3 we compute 7f/(7t(y)) = X\ chaine_multadd(£, y,-, y, _R,)) where X\ is given 
in Step 2 by by y = A^ chaine_multadd(£, y;, R,, y) . 

We can easily recover 7t(y) from the ni{ft{y)), i G Z(£), but we note that it is faster 
to only compute the tt; (7t(y)) only for / G & (with the notations of Example 5.3 in the 
preceding section), and then do a point decompression (see Algorithm 5.7). This last 
step is of course unnecessary if the compressed coordinates of 7r(y) are sufficient. 

To compute Tti{l.x), we need to do two multiplication chains of length I. We obtain 
the compressed coordinates of l.x after g[g + l)/2 such operations. In total we can 
compute the compressed coordinates of a point in 0{\g{g + 1) log(^)) additions in Bj. 
(with \g{g + l)nS divisions in k) and the full coordinates in 0{iS) additions in Bj^. We 
recover the equations of the isogeny by applying this algorithm to the generic point of 
B^ <> 

The case [n, t) > 1 In this case we have to use © = {ei, ■ ■ ■ £2,- ■ and in 

this case if i G &, Rj is a point of £m -torsion. But we have by Remark 4.14 

{l,£i,0).y = X\ chaine_multadd(£, 7T"(x),R/,y), 

so that we can still recover X\. 

The case n = 2 The only difficult part here is the ordinary additions y + K„ since the 
addition chains do not pose any problems with n = 2. In particular, we first choose 
one of the two points ±(x ± ), which requires a square root. Now, since we have 
Oyi^ given by a theta structure of degree In > 2, we have the coordinates of Rgj + R/ 
on Bj;. This means that we can compute the compatible additions x + R, from x + R^x 
and + R,. 

5.3 Computation of the kernel of the isogeny 

We know that the kernel of the isogeny zr : B ^ A is the subgroup X generated by 
{K^. g]. Lety G B|j.[^], up to a projective factor, we may suppose that chaine_mult(i',y) = 
Ogj^. Then y is in X if and only if for all i G Z(?) we have Tfi{7T{y)) = K,-. Let 
y + R, be any affine point above y + K,. Since y and Rj are points of £-torsion, for 
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all i e Z(£), there exist a,-, j6/ e fc* such that chaine_niultadd(£,i/ + Ri,y,Ri)) = OiiRi 
chaine_multadd(^,i/ + Ri,Ri,y) = fijy. By Theorem 5.8, we know that 7f/(7t(y)) = 
j:Ri- In particular y e K if and only if = 1 for all f e Z(£n). 

In fact, we will show in Section 7 that a,/ /5; = e^(i/, K,) where is the extended 
commutator pairing from Section 4.1. We obtain that y is in K if and only if ewiy, Ri) = 
1 for i E {di, ■ ■ ■ ,dg}. 

6 The computation of a modular point 

In the Section 6.1 we explain how to compute the theta null point 0^^ from the knowl- 
edge of the kernel of ft. This section introduces the notion of a "true" point of £-torsion, 
which is an affine lift of a point of £-torsion that satisfy Equation (27). We study this 
notion in Section 6.2, and we use these results in Section 6.3 where we study the 
computation of all (or just one) modular points. 

6.1 An analog of Velu's formulas 

We have seen in Section 4 how to use the addition formula to compute the isogeny 
TT : Bj. — >• Aj-. For this computation, we need to know the theta null point (^i)/ez(S) 
corresponding to Aj.. In this section, we explain how to recover the theta null point 
(^');eZ{fi;)' given the kernel K = {T;} -g^fi) of ft, by using only the addition relations. 
This gives an analog to Velu's formulas for higher genus. As in the course of the 
algorithm we have to take £'''-root in k, we suppose that k is algebraically closed. (If 
k = F^, with £\q — 1 so that we have the i'-root of imity, we only have to work over an 
extension of degree £ ofk). 

Let {T^jj, ■ ■ ■ , T^^} be a basis of K. Let i(ii)j^z{In) theta null point correspond- 

ing to any theta structure on Aj. compatible with the theta structure on Bjj. The com- 
patible automorphisms of the theta structure on Aj. allows us to recover all the theta 
null point of the compatibles theta structures on Aj., via the actions: 

{^i}tez{i) ^ {^i>i(i)}iGZ{ey (24) 
{^<}z6Z(Z) ^ MMi)'i)Ri}iez{ly (25) 

where ipi is an automorphism of Z{i) and ip2 is a symmetric endomorphism of Z{i) 
(see [FLR09, Prop. 7]). The Rj were defined in Section 4.1, and we recall they determine 
Oj^i^ entirely. In fact the results of Section 5.1 show that Oy\^ is completely determined 
by {Rdi,Rdi+di}i,je[i..g] where rfi, • ■ ■ ,dg is a basis of Z(Z). 

Up to an action (24) we may suppose that 0^,^ is such that 7?^, (O/i^ ) = T^. . Fix 
i E Z(£). Let Tj be any affine point above T,-, we have K/ = A,- T,- . Write £ = 2£' + 1, since 
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Ri is a point of ^torsion, we have (1, f + 1, 0).R, = - (1, f , 0)._R/. By Proposition 4.11 
and Lemma 4.8, we have 

chaine_mult(i!' + 1, R/) = — chaine_mult(£', _R/), 
A^*^ ''^^^ chaine_mult(£' + 1, Tj) = — A^ chaine_mult(A:, T,), 

A^ chaine_mult(£' + 1, T,) = — chaine_mult(i?', T/). (26) 

Hence we may find A, up to an i'^'^-root of imity If we apply this method for i E 
{d-i, ■ ■ ■ ,dg,di + ^2, ■ ■ ■ ,dg-i + dg}, we find Ri up to an ^'''-root of unity But the 
action (25) shows that every choice of R, comes from a valid theta null point O^j. . 

Algorithm 6.1 (Velu's like formula): 

Input T(jj, ■ ■ ■ Ti}^ a basis of the kernel K of n. 

Output The compressed coordinates of 0^;., the theta null point of level in correspond- 
ing to ft. 

Step 1 For i,] E [l--g] compute the points T^j. + . Let & = {di, ■ ■ ■ ,dg,di+d2,- ■ ■ dg-i + 
dg}. 

Step 2 For each i E & choose any affine lift of T,, and compute {li^j)ji£Z{n) '■— 

chaine_mult(£', Tj'), and {Yj)j£Z{n) '■— chaine_mult(^' + l/T^')- 
Step 3 For each i E & compute a,- such that {7'j)j^z{n) ~ '^i{f^'-j)jez{n)- 
Step 4 For each i E 6, output R, := (a,) ? ■ T/. 

Correction and Complexity Analysis 6.2: 

In Step 4 we compute R,- be any of the £ affine lift of T,- such that: chaine_mult {£' + 
l,Ri) = — chaine_mult(£', R;). Then {Ri}ie6 give the compressed coordinates of Oy^i^, 
we can then recover Oyij. by doing a point decompression (see Algorithm 5.7). 

To find Ri, we need to do two chain multiplications of length £/2, and then take 
an ^^''-root of unity After g{g + l)/2 such operations, we obtain the compressed 
coordinates of a 0^^,, and we may recover the full coordinates of the corresponding 
0^^ using the point decompression algorithm 5.7. We remark that we only need the 
compressed coordinates of 0^^^ to compute the compressed coordinates of ft. In total we 
need to compute g{g + l)/2 -roots of unity and 0{2g{g + 1) log(^)) additions in B/^ 
to recover the compressed coordinates of O/i^ . We can then recover the full coordinates 
of 0/^1^ at the cost of 0{i^) additions in Bj-. 

Remark 6.3: 

Each choice of the g{g + l)/2 -roots of unity give a theta null point corresponding 
to the same Abelian variety Aj. = Bj^/K. However, each such point comes from a 
different theta structure on Aj^, and hence give a different decomposition of the £- 
torsion A[£] = Ki{£) ® K2{£). Since = A,,/K2{£), K2{£) = Kis fixed so that each 
point gives a different K-[ {£). This mean that if C)t = A^-/ Ki {£) we can recover different 
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^^-isogeny Bj. Q from such choices (see Section 3.3). By looking at the action (25), 
we see that there is a bijection between the £Sis+'^)/^ choices and the £^ isogenies whose 
kernel M.cB^is such that J^[£] = K. 

The case {n,i) > 1. In this case once again we have to recover Rj for f e © = 
{ei, ■ ■ ■ ,eg,ei + 62, ■ ■ ■ ,ei + Cg}. Suppose that we have points of £n- 

torsion such that £.T, = (1,£z,0).0b. Once again if i E &, we may suppose that 
Ri = A,T,-. 
We have if £ = + 1 is odd: 

Af chaine_mult(/ + l,f/) = -(1, ^(n - 1),0). chaine_mult(f , f,) 

so that once again we can find Aj. 

The kernel of ft is then K = {wT;} .^^^ij. Even if K is isotropic, the 
not be, so some care must be taken when we choose the 

If ^ = 2£' is even, we have: 

Af^chaine_mult(/ + l,f,) = -(1, £(n - 1),0). chaine_mult(/ - 1, f,) 

so we can recover only Ap. But every choice still corresponds to a valid theta null point 
(fl,) because when 2\£, to the actions (24) and (25) we have to add the action 

given by the change of the maximal symmetric level structure [FLR09, Proposition 7]. 

The case n = 2 Once again, the only difficulty rest in the standard additions. Using 
standard additions, we may compute R/,^ ± R^^, ■ ■ ■ ± Rg^, making a choice each 
time. Then we can compute Re^ + Rcj by doing an addition compatible with Re^ + Rcj 
and +Rej. 

6.2 Theta group and ^-torsion 

Let X E Bjt be such that pg^^ (x) is a point of ^-torsion. We say that x is a "true" point of 
^-torsion if x satisfy (see (26)): 

chaine_mult(£' + l,x) = — chaine_mult(^', x). (27) 

Remark 6.4: 

If X is a "true" point of ^-torsion, then Lemma 4.8 shows it is also the case for Ax for 
any A an i'^'^-root of unity. () 

We have seen in the preceding Section the importance of taking lifts that are "true" 
points of £-torsion. The aim of this section is to use the results of Section 4.3 to show 
that the addition chain of "true" points of ^-torsion is again a "true"-point of ^-torsion. 
We will use this in Section 6.3 to compute "true" affine lifts of Bj, [£] by taking as few 

-roots as possible. 
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We will use the affine lifts of points in Bj.[^] that we have introduced in Section 4.1 
to study this notion. Let = [£]*Jzfo on Bj- and &B^,^go a theta structure for 

compatible with ©g^. Recall that we note Bj- the affine cone of (B^-, ^o)/ ^rid [^] the 

morphism B/^ ^ Bj- induced by [i]. Since — -^o^^ the natural action of G(^o) on 

H''(^o) give via &Bk,.^o ari action of ^{f-n) on H^{^o). 



X 



Lemma 6.5: — i 

Let y e Bjt[^], y e Psl^y) ^^'^ ^ ^ [^] (y)- '^^^'^ there exists {ix,ni,nj) E k^' x Z{P-n) 
Z{f-n) such that x = {a, ni, ni).0~i. Moreover, y is a true point of l-torsion if and only if 
a = Xi^jji where ji is an l^^-root of unity and Ai^j = ec{i, —jY "(^~^). 

dfx' e B^', then x' e R|~\y) if and only if x' = {l,£i',£f).x where {i' ,f) e Z(Wn) x 
Z{P-n)), so the class of a. in k* /k*^ does not depend on xbut only on y). 

Proof: Since p~i{x) e Bjt[^^], there is an element h e 7i{fin) such that x = h.O~i, 

'^k ^k 

with h = {oc,ni,ni). By Remark 6.4, we only need to check that {Ai j,ni,nj).0~! is 

a "true" point of Morsion. Let m G Z, and let Xm = chaine_mult(OT,x), y„t = 
chaine_mult (?n,y). By Corollary 4.16 we have x„, = {l,m ■ i,m ■ i)-0~i, and by Corol- 

^k 

lary 4.16 y^ = [£] (1, m ■ i,m ■ 7).0~,. So by Lemma 4.10 y^, = [£] (1, f ■ i, £' ■ i).0~, = 
ec{ni,£n{£-l)i)[£]{lj' ■ i + £n{£ - ■ j + £n{£ - 1)).0~, = Ar/[^](l, -(f + 1) . 

Die 'J 



i--{^' + 1) = A,r.^[£](-x,,+i) = -X7^y, 



+1- 



Proposition^.6: ^ 

Lety\,yi,y\ — y2 G Bj^ be points of "true" £-torsion.Thenyi +y2 '■= chaine_add(yi,y2,yi 
is a "true" point of £-torsion. 

Proof Let {cci,ii,ii) e 'H{£^n), {aiAi^ii) G 'H{£^n), {a^J^,!^) e be such that 

[£] {oil, ii'h)-\' = yi' M {0^2, iirh)-'^^' = [£] (^3/ h,j3)-0^^' =y\-vi 

By the Remark at the end of Lemma 6.5, we may suppose that 23 = i\ — i^, 73 = ]\ — ]i- 
Since y\, 1/2 and y\ — y2 are "true" points of ^-torsion, by Remark 6.4 and Lemma 6.5 
we may suppose that ol\ = Af^^j^, a.2 = A^^jj and ^3 = Ai^_i^^j^_j^. 
By Corollary 4.16 and Lemma 4.8, we have 

yi+yi = {l,ii+ii,h +72)%' = (A,-j+,2,yi+/2'''i +''2'yi +72)%', 

^h-'2,ii-i2 

so yi + y2 is indeed a "true" point of ^-torsion by Lemma 6.5. ■ 
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6.3 Improving the computation of a modular point 

In [f LRO ], to compute the modular points Oai., the following algorithm was used: 
write the Riemann relations of level in to get a system in which we plug the known 
coordinates Og^, . We obtain a system S of with a finite number of solutions, that can be 
solved using a Grobner basis algorithm. But even for g = 2 and £ = 3, the system was 
too hard to be solved with a general Grobner basis algorithm, so we had to design a 
specific one. 

In this section we explain how, using the "Velu's"-like formulas of Section 6.1, 
it is possible to recover every modular point solution of the system S from the 
knowledge of the ^-torsion of Bj^. We then discuss different methods to compute the 
i'-torsion in Bj^. 

Algorithm 6.7 (Computing all modular points): 

Input Ti, ■ ■ ■ , T2i, a basis of the Morsion of Bj.. 
Output All £-isogenies. 
We only give an outline of the algorithm, since we give a detailed description 

in Example 6.8: Compute any affine "true" ^-torsion lifts Ti, ■ ■ ■ , T2g, Ti + T2, ■ ■ ■ , 
T^_l + Tg, and then use addition chains to compute affine lifts T for every point 
T E B/f [£] . By Proposition 6.6 T is a "true" point of ^-torsion. 

For every isotropic subgroup K c Bi^[£], take the corresponding lifts and use them 
to reconstitute the corresponding theta null point 0^^ (see Section 6.1). 

Example 6.8: 

Suppose that {Tj, . . . , T2^} is a symplectic basis of Bj.[£]. (A symplectic basis is easy to 
obtain from a basis of the ^-torsion, we just need to compute the discrete logarithms of 
some of the pairings between the points, and we can use Algorithm 7.5 to compute 
these). 

Let &Bi„^^o theta structure of level i^n on Bj- compatible with ©g^,, and 
Og^ be the corresponding theta null point (see Section 4.1). We may suppose (see 
Section 6.1) that fi = \e]{l, {n,0, ■ ■ ■ ,0),0).0'b^, = [£]{1, {0,n, ■ ■ ■ ,0),0).0'b^, . . ., 
f^t = M(l,0,(n,0,---,0)).0'B^,Tf^ = l£j(l,0,(0,n,---,0)).0'B^ T1T1J+2 = 

M(l,(n,0,--- ,0),(0,n,0,--- ,0)).0'b^,,... 

Then by Corollary 4.16, using Algorithm 6.7, we compute the following affine lifts 
of the ^-torsion: 

{\£]{l,in, jn):6's^ : i,j e {0,1, ■■■ J - IV C Z{e^n)}. (28) 

Now if K C Bj.[^] is an isotropic group, in the reconstruction algorithm 6.1 we need 
to compute points of the form [£] (1, in,in).Q'^^ for i,] E Z{f-n). But we have 

M(l,m,7n).0'B,^ = ^^^/^"■(^■-^'^)"(l,^«n,£/3n).(l, [i - ioi)n, {j - ^/3)n).0'B^ 

= Je]^fP"<'~f'-)"{l, {i - ia)n, a - ifi)n)R, 
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where ix,fiG Z{i'^n), and ^ is a (£-^n)"'-root of unity. As a consequence, we can always 
go back to a point computed in (28) up to an ^^''-root of unity. 

We give a detailed example with g = 1, = 3, n = 4. Let B|t t>e an elliptic curve, with 
a theta structure ©b^ of level n. Let Tj, T2 be a basis of Bj-[£], and choose "true" affine 

lifts Ti, T2, Ti + T2- Let ©g^ be any theta structure of level i^n compatible with ©b^/ 
and Og^ be the corresponding theta null point (see Section 4.3). We take ©g^ such 

that fi = M(l,n,0).0'g^, f2 = \e]{l,0,n).\, and tT+Ts = l£i(l,n,M)£g^. 

We have seen in (28) that in the Algorithm 6.7 we compute the points: [i] (1, in, ; w) .Og^ 
for i,j e 0, 1, ■ ■ ■ 1 C Z/e^nZ. 

Now let T = [£](!, M,2n).0g^, K =< Pbi,{T) > is an isotropic subgroup of Bif[£]. 

Let A J. = Bjf/K, choose a compatible theta structure ©yi^ on A, and let 0^^ be the 
associated theta null point. 

As usual, we define Ri = zf (Oy^i^ ) if ^ G Z/£Z c Z / ^nZ, and we may suppose 
(Section 6.1) that ©/^^ is such that Ri = T. More explicitly, if n = 4 we have Oy^i^ = 

(fl0/«l/«2/a3/«4/fl5/fl6/«7/fl8/fl9/«10/«ll)/ ((x,),gz/12z) = (xq, X3, Xg, X9) SO that Rq = 

(fl0/«3/fl6/'?9) = Ob^ (Remember that we always choose 0^^ such that 7r(0^^) = Og^.), 
Ri = (fl4, fly, flio,fli) and R2 = (flg, flu, fl2/'^5)- Now by Theorem 5.4 we know that Oy^i^ 
is entirely determined by Ri (and Og^^), in fact we have: R2 = chaine_add(Ri, Ri,Og^). 
By Corollary 4.16, we have 

R2 = M(l,2n,4n).0'g,^ = M^^"-3"(l,0,3n).(l,2n, n).0'g^ = ^^"■^"[£]{l,2n,n):6'j^^, 

where ^ is a (£^n)'''-root of imity 

This shows that in the reconstruction step, we have to multiply the point [i] (1, 2m, m).0^ 
which we have already computed by the £-root of unity ^^n-fn 

Complexity Analysis 6.9: 

To compute an affine lift T,, we have to compute an ^^''-root of unity (and do some 
addition chains but we can reuse the results for the next step). Once we have computed 
the i{2£ + l)-root, we compute the whole (affine lifts of) ^-torsion by using 0(£^^) 
addition chains. We can now compute the pairings e(T,, Tj) with just one division 
since we have already computed the necessary addition chain (see Section 7). From 
these pairings we can compute a symplectic basis of B]^ [i] . This requires to compute 
the discrete logarithm of the pairings and can be done in O(^). Using this basis, we 
can enumerate every isotropic subgroup K C Bj.[i'], and reconstruct the corresponding 
theta null point with O ) multiplications by an ^^''-root of unity. <0 

The case {n,£ > 1) In this case, the only difference is that we have to compute Bj- [£n] 
rather than Bj-[^], and when T, is a point of ^n-torsion, we compute an affine Lift T, 
such that: 

chaine_mult(/ + l,f,) = -(1,^(m - 1),0). chaine_mult(f ,1;). 
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The case n = 2: This works as in Section 6.1, once we have computed the + Tg., 
we have to take compatible additions to compute the Tg. + T/,. . 

Computing the points of ^-torsion in B^: The first method is to use the Riemann 
relations of level 5 = {n,n,n, - ■ ■ An). Let cp : Z{n) ^ Z(<5) be the canonical injection. 
Let be the modular space of theta null points of level S, and Vj the subvariety 
defined by the ideal / generated by a^^j^ = for i e Z(n). 

Then to every (non degenerate) point solution correspond an isogeny tt : Aj- ^> Bj-. 
The kernel of the contragredient of tt is then of the form {Ob^., T, 2T, ■ ■ ■ , {£ — 1)T} 
where T is a primitive point of ^-torsion. We may recover T as follows: if f e Z/ iZ, 
let TZj = no si (0, 0, ■ ■ ■ , ni), then we have tt,- (0^^ ) = i ■ T. 

By using this method for every point solution (even the degenerate ones), we find 
all the points of ^-torsion (the degenerate point solutions giving points of £-torsion 
that are not primitive [FLR09, Theorem 4]). 

When we look at the equations of Vj, we see that we can reformulate them as follows. 
Let Ri, ■ ■ ■ , R/_i be the £ — 1 projections of the generic point of Bj- x Bj. x ■ ■ ■ x Bjt 
and let Rq = Ob^ - Then the equations on B^ comes from the addition relations: for all 

i,i e z{I), 

Ri+j = chaine_add(R/, Ry,R,„y). 

We see that we can describe the system with less unknowns and equations by 
looking only at equations of the form: 

R2; = chaine_add(R;, R/,Ro), 

R2/+1 = chaine_add(R,+i, R/, Rq). 

This requires n^O(log(^)) variables, and each equations is of degree 4. 

A second method is to work directly over the variety Bj-. The Riemann relations (11) 
allows us to compute the ideal of ^-division in B/^. Here we have nS unknown, but the 
equations are of degree t^^. Contrary to the first method, we recover projective points 
of i?-torsion, so we have to compute an l^^-rooi of imity to compute a "true" affine lift 
of ^-torsion. But this mean that the degree of our system is f'S rather than so a 

generic Grobner basis algorithm will finish faster In genus 2, using a Core 2 with 4 GB 
of RAM, this allows us to compute up to £ = 13. 

In general we prefer to work over the Kummer surface (so with n = 2), since it 
cuts the degree of the system by two. In genus 2, Gaudry and Schost [ ] have an 
algorithm to compute the ^-torsion on the Kummer surface using resultants rather 
than a general purpose Grobner-based algorithm. The points are given in Mumford 
coordinates, but we can use the results of Wamelen [VVam*-^'^] to have them in theta 
coordinates. With this algorithm, we can go up to £ = 31. This algorithm is in 0{£^) 
(where we use the notation O to mean we forget about the log factors). The computa- 
tion of the "true" affine points of ^-torsion from Algorithm 6.7 is in 0(£4),and each of 
theO(^3) 

isogeny requires 0{fi) multiplication by an ^"'-root of unity. In total we see 
that we can compute all (£, ^) -isogenics in 0(^^) in genus 2. 
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Lastly, if we know the zeta function of Bj^ (for instance if B^- comes from complex 
multiplication), we can recover a point of ^-torsion by taking a random point of Bj. and 
multiplying it by the required factor. 

Isogenies graph: 

Usually when we compute every isogenies, this is to build isogenies graph. However, 
our Vein's like algorithm from Section 6.1 gives us a theta null point 0^^^ of level in 
from a point of level n. We can use the Modular correspondence from Section 3.3 to go 
back to a theta null point of level n, but the corresponding isogeny ^ Q is a £^ 
isogeny so with our method we can only draw ^^-isogenies graphs. 

There is however one advantage of using the intermediate step Oa^'- since it is a 
theta null point of level £n, we have all the ^-torsion on A/^. Let 7T2 : Aj- ^ Q be the 
corresponding isogeny, K2 := 7T2(Aj.[^]) gives us half the ^-torsion of C]^. (to get an 
explicit description of K2, just apply 3 to the results of Section 3.4). Since K2 is the 
kernel of the dual isogeny C/^ Aj^, this allows us to build an isogeny graph of £^ 
isogenies where the composition of two such isogenies give an £^ -isogeny and not (for 
instance if g = 2) a (1, l^, f, t) -isogeny (it suffices to consider the isotropic subgroups 
of C/([£] that intersect K2 trivially). The knowledge of K2 also allows us to speed up the 
computation of Q \P\ : In the following section, we will give an algorithm to compute 
the extended commutator pairing e on Let (Gi, ■ ■ ■ , G^) be a basis of K2, and 

consider the system of degree £S^^ given by the ideal of ^-torsion and the relations 
e(G/, ■) = 1 for i E [2..g]. Let Hi be a point in this system different from < Gi > (it 
suffices to check that e(Gi, Hj) 7^ 1. We can now construct the system of degree i^ 
given by the ideal of i'-torsion and the relations e(G/, ■) = 1 for i 7^ 2 and e{Hi, ■) = 1; 
and look for a solution H2 such that e(G2, H2) 7^ 1. We see that we can construct a basis 
Gj, ■ ■ ■ , Gg, Hi, ■ ■ ■ , HgofC]([£] by solving a system of degree £S~^^, then of degree i^, 
... , then of degree £'^. This is faster than solving the ideal of ^- torsion which is a system 
of degree £'^S. 

7 Pairing computations 

In this section, we explain how to use the addition chains introduced in Section 4.2 
in order to compute the commutator, Weil and Tate pairings on Abelian varieties. 
We suppose here that B}^ is provided with a polarization ^0 which is the n"' power 
of a principal polarization. This allows us to make the link between the extended 
commutator pairing and the Weil pairing in Section 7.1. We then give an algorithm to 
compute the extended commutator pairing in Section 7.2. 

7.1 Weil pairing and commutator pairing 

We recall the definition of the extended commutator pairing from Section 4.1: Let 

■^0 = [^]*-^0 on Bj^. As J^Q is symmetric, we have that ~ J^^^ and as a consequence 
K{^q), the kernel of ./#o is isomorphic to K{£'^n). The polarization induces a 
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commutator pairing ([Mumob]) on K{^q) and as descends to J^q via the 
isogeny [£], we know that e is trivial on Bj;[£]. For x\, E B]^[£], let x[, G 
be such that £.x'- = x, for / = 1, 2. The extended commutator pairing is then e'g{xi, X2) = 
^ ^o(^'l'^2) = e4!f(j(xi,X2)' this is a well defined bilinear application : Bj^li] x Bi^[i] 
k. As e^jj is a perfect pairing, for any x[ G Bfc[^^] there exits G Bi-[£^] such that 
e (x'^, X2) is a primitive root of unity. As a consequence, for any Xi E Bj.[£] there 
exists X2 e B;.[£] such that e^(xi,X2) is a primitive root of unity and e'^ is also a 
perfect pairing. 

As the kernel of ^0 is Bj-[m], we have an isogeny Bjt — )• Bj- with kernel Bj-[n] and 
by composing this isogeny on the right side of e'^, we obtain a perfect pairing : 

Bif[£] X Bif[£] }i£ where }i(is the subgroup of -roots of unity of k. 
We have 
Proposition 7.1: 

The pairing e'y^ is the Weil pairing e^. 

Proof: For y E Bi^[£], we denote by Ay the degree-0 line bundle on B;, associated to y. 
We first recall a possible definition of the Weil pairing eyv- Let (x, y ) E Bj- [^] x Bj- [^] . Let 
i^Bi- be the structural sheaf of B^^, and as y G Bj. [£] there is an isomorphism ip'y : [^] * Ay 
^Bj^- As a consequence. Ay is obtained as the quotient of the trivial bundle B]^ x Aj. 
over B/f by an action g of Bj. [i?] on B/^ x given hy gx{t, a) = {t + x,x{x).(x) where 
(f,a) E (Bj; X A^)(A-), X E Bi^[£] and ;t is a character of Bk[£]. By definition [Mum70], 

wehave ew(^/y) = xi^)- 

In order to give another formulation of this definition, we chose an isomorphism 

^B^,(0) ~ A: from which we deduce via !/;y(resp. T*ipy) an isomorphism !/?o : [£]*Ay(0) ~ 
k (resp. xpi : T*[£]*Ay(0) ~ k). There exists a unique isomorphism ipx : [^]*Ay 

[^]* Ay compatible on the fiber with ipQ and ipi, i.e. we have that ipi o ip^ o ip^^ is 
the identity of k. Then, the following diagram commutes up to a multiplication by 

ew{x,y): 



[£]*Ay 



ew{x,i/) 



T*M*Ay ) T*^B 



The polarization gives the natural isogeny cp j^^, defined on geometric points by 

(pj^^ik) : B,{k) ^ B,{k) 

y^ Ay = ^o®(Ty*=2'o)-^ 

As a consequence, for y E B]([£] there exists yo e Bjt(A') such that Ay = ^0 ® (Xy^j^o)"^- 
Let y' e B^,[^2] g^^^ ^xat £.y' = yo. As [£]*^q = Ji^, we have [^]*Ay = [£]*(ifo 
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^0 ® i^'^oY 



^0 ® (t^P^o) ^- We remark that the isomorphism xpy : [i]*Ay 



gives by tensoring on the right by t*,^q an isomorphism 
T*,^0- Thus, the following diagram is commutative up to a multiplication 



t;,^Px 



T. 



x+y'- 



But this is exactly the definition of (x, y) thus we have (x, y ) = ew y ) ■ 



7.2 Commutator pairing and addition chains 

In this paragraph, we explain how to compute the pairing using addition chains. 
From Section 7.1 this give a different algorithm to compute the Weil pairing than the 
usual Miller loop [Mil04]. We chose a theta structure &Bi^,^q for .-^o compatible with 
©Bj. (see Section 3.3) from which we deduce a decomposition K{^q) = Ki{^q) x 
^2(^0) of K{^o) into isotropic subspaces for the commutator pairing and a basis 
Z{¥n) °^ H^i^o)- We recall that there is a natural action of G(^o) on H'^(^o) 
which can transported via 0b^,.^o ^° action oiT-L{P-n) on H'^(./#o)- Let x,y e 
and x',y' e Bfc[^^] be such that £.x' = y and £.y' = y. We put x' = + ^2 and 
y' = y'j + with xj,yj e K, (^o)/ for i = 1,2. Let k : G(^o) ~^ ^^^(.'^o) be the natural 
projection and let (ai,a2)/ {^iif^i) G Z(£2j|) x Z{P-n) be such that K:(0B^ _^g(a,)) = 
x[ and k(0Bj. ^(j(/3i)) = y-. This mean that we have x' = (l,ai,a2).0^^ and y' = 
(l,/3i,/52).0^; 

Lemma 7.2: 

Let f e Z(£2m) and put 



sil] 



For all k &'N,we have 



((l,ai,0).(l,/3i,0).!9,)(OBj MOb,) 



((1,<^i,0).!?0(ObJ ((1,/5i,0).!?,)(0bJ 



^ ((1,«i,0).(1,L/3i,0H-)(0bJ '?,(ObJ ^ .J.. (29) 

((1,«i,0).i?,)(0bJ ■((1,/c./3i,0).!9,)(Ob,) 

Proo/' Consider the degree-0 line bimdle A = t*,^q ® ^q"^. We remark that as 
y[ G X(./^o)/ ^ is isomorphic to the trivial line bundle on Bjj. Let K be the subgroup 
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of Ki {^o) generated by and let Q be the quotient of Bj- by K. The line bimdle A 
descends to a line bundle A' over Q-. As A' has degree 0, it is the quotient of Bj- x 
byanactionof theformg!f(t, a) = {t -\- x,xoix).ci),where {t,a) e Bj^x A^,x e K,and 
Xo is a character of K. 

As!?; e H°(^o)/ we remark that/ = ((l,,6i,0).!?/)/(i?,) is a section of A. Thus, we 
haves(fc) = f{k.x[)/f {Ob,) =Xoik) and s{k)=s{l)K U 

Remark 7.3: 

We remark that in the preceding lemma, cti and /5i play the same role and as a conse- 
quence can be permuted. 

We keep the notation of the beginning of this paragraph to state the 

Proposition 7.4: 

We put: 

_ ((!,£.«! +/5i,£.a2 + /52)i?/)(OBj MOb,) 



R 



((1,/5i,/32)!?/)(Ob,) ((l,lai,£a2)!9,)(0Bj 
((!,«! + l/3i,a2 + ^./52)!?/)(OBj MObJ 



((1, ai, a2)!90 (ObJ ((1, L^2)di) (ObJ 

We /zfli^e ; 

e'^{x,y) = L-^.R. (30) 

Proof: In order to clarify the notations we denote by ec the canonical pairing between 
Z{£^n) and Z{P-n). First, we compute L. We have: 

(1, tdi + ^1, £.a2 + ^2)!?/ = ec{Lai + ^1, -La^ - ^2) (1, ^.a + h' 0) (1^ 0^ ^■a2 + ^2)!?/ 

= ec(^.ai + ^1, -^.^2 - ^2)(l,^.ai + ^i,0)!?,-. 

In the same way, we have: 

{l,LoLi,£.OL2)&i = ec{e.ai,-e.0C2)ilJ.(Xi,0)^i. 

Taking the product, we obtain that 

L = e,(£.ai,-^2).L', 

with _ _ 

((l,/3i,0).(l,l^i,0)i?,)(0Bj i?,(OBj ^ 

(1,/5i,0)i?,(0bJ (l,£ai,0)!?,(OBj' 
In the same manner, we have: 

R = ec{l.^i,-a2).R', 
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with _ _ 

_ ((l,«i,0).(l,£/3i,0)i?,)(0B,) i?,(OBj ^ 

(l,ai,0)t?,(OB,) (l,£/5i,0)i?,(0Bj' 
Using lemma 7.2 and the fact that (1, ai, 0) commutes with (1, j6i, 0) we get that L' = R'. 
Therefore, 

The preceding proposition gives us an algorithm to compute the pairing: 

Algorithm 7.5 (Pairing computation): 

Input P,Q e Bi.[£] 
Output 4(P,Q) 

Let P, Q G and choose any affine lift P, Q and P + Q, we can compute the 

following via addition chains: 

Ob, P 2P ... £P = A°pOb, 

Q P + Q 2P + Q ... eP + Q = XlQ 

2Q P + 2Q 



iQ 



AOqOb, 



p + eQ = \}^p 



Namely we compute: 

£P := chaine_mult(£,P) 
eP + Q:= chaine_multadd(t -P + Q,-P,Q) 
Then we have: 

e'e{P,Q) = 



:= chaine_mult(£, Q) 
P + eQ := chaine_multadd(t P + Q, Q,-P). 



4^ 



(31) 



Proof: AssumethatP,QandP + QaresuchthatP= [£](l,ai,^i)0^^,Q = [£](l,a2,j62)0'g^, 
and P'+Q = l^(l,ai + a2/^i + hWsr Then by Corollary 4.16, we find that A° = 



MO) 
we have: 



1 and that Ap 



"^'-(\tfcSg;y^'°' - - by Proposition 7.4, 



e'e{P,Q) 



AiAj 



Now by Lemma 4.8, it is easy to see that (31) is homogeneous and does not depend 
on the affine Hfts P, Q and P + Q, which concludes the proof. ■ 
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Complexity Analysis 7.6: 

By using a Montgomery ladder, we see that we can compute e'f/iP, Q) with four fast 
addition chains of length £, hence we need 0(log(£)) additions. It should be noted 
that we can reuse a lot of computation between the addition chains P, 2P, AP, . . . 
and P + Q,2P + Q,AP + Q, . . . since we always add the same point at the same time 
between the two chains. <0 

Thecasen = 2 Let±P,±Q e KB,thenwehave4(±P,±Q) = {e'^{P,Q),e'g{P,Q)-^}. 
Thus the pairing on the Kummer variety is a bilinear pairing Kg x Kg ^ k*'^ where 
k*'^ = k* / {x = 1/x}. We represent a class x e A:*'^ by x + 1/x G k, and we define 
the syntmetric pairing e'g{±P, ±Q) = e'f{P, Q) + e'f^{P, — Q). We can use the addition 
relations to compute P±Q and then use Algorithm 7.5 to compute e'g{P, Q), e'^{P, —Q), 
but since e'g is symmetric there should be a method to compute it without solving the 
degree-2 system given by the addition relations. This will be the object of a future 
article. 



8 Conclusion 

We have described an algorithm that give a modular point from an isotropic kernel, and 
another one that can compute the isogeny associated to a modular point. By combining 
these two algorithms, we can compute any isogeny between abelian varieties. However, 
the level of the modular space that we use depend on the degree of the isogeny. That 
means that a point in this modular space corresponds to an isogeny and to the 
choice of a symplectic basis of Bj. [£] . So in our case it is easier to compute directly the 
points of ^-torsion in 6;^ than to compute directly the modular points in M.j^ since 
the degree of this latter system is higher These remarks mean that we cannot use our 
algorithm to speed up Schoof point counting algorithm, like in the genus-one case (see 
for instance [ ]). A solution would be to have an efficient characterization oi M.j^ 
modulo the action by the symplectic group of order I. 

Still, we can go back to a modular point of level n by using the modular correspon- 
dence introduced in [ ]. This mean that we can compute isogeny graphs if we 
restrict to £^-isogenies. We have also introduced a point compression algorithm, that 
allows to drastically reduce the number of coordinates of a projective embedding of 
level AE. This new representation can be useful when one has to work with such a 
projective embedding, rather than the usual one of level 4 (for instance if one need a 
quick access to the translation by a point of ^-torsion). 
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